Wiki

Scale Your Enterprise

User Tools

Site Tools

Trace:
kb:kb_item_364

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision 		Previous revision
kb:kb_item_364 [2021/12/16 11:39]
mneuendorff created 		kb:kb_item_364 [2021/12/17 08:51] (current)
mneuendorff
Line 1: Line 1:
-2021-12-16 3131789 +**Log4Shell (Log4j2) Vulnerability 
-3131789 - Mitigate Log4j CVE-2021-44228 Vulnerability +** 
-in SAP Business One + 
-Version 1 Type SAP Knowledge Base +What is Log4Shell? 
-Article +Log4Shell is a high severity vulnerability (CVE-2021-44228, CVSSv3 10.0) impacting multiple versions of the Apache Log4j 2 utility. It was disclosed publicly via the project’s GitHub on December 9, 2021. This vulnerability, which was discovered by Chen Zhaojun of Alibaba Cloud Security Team, impacts Apache Log4j 2 versions 2.0 to 2.14.1. The vulnerability allows for unauthenticated remote code execution. Log4j 2 is an open-source Java logging library developed by the Apache Foundation. Log4j 2 is widely used in many applications and is present, as a dependency, in many services. These include enterprise applications as well as numerous cloud services. 
-Language English Master + 
-Language English +Does this affect any Third Wave software? 
-Release +Since this vulnerability only affects applications using Log4j, the open-source Java logging library, it does NOT affect any Third Wave software.  
-Status Released to Customer Category How To + 
-Component SBO-CRO-SEC (Security in SAP Business One +Does this affect SAP software? 
-software) Released On 15.12.2021 +At this time, SAP continues to investigate the remote code execution vulnerability (CVE-2021-44228) related to Apache Log4j disclosed on Dec 10, 2021. SAP encourages our customers to update to the latest version of Log4j, where applicable. Currently, SAP does not have a workaround for SAP Business One. SAP Business One is currently in a Patch Pending status with SAP. Most of the SAP Business One Apache/Java applications are internal only. These include System Landscape Directory, Job Server, Service Layer, etc. Since they are internal only, this appears to reduce the vulnerability risk.  
-Please find the original document at https://launchpad.support.sap.com/#/notes/3131789 + 
-Symptom +{{ :kb:b1update.png?400 |}} 
-• Vulnerability CVE-2021-44228 for log4j + 
-• How does this impact SAP Business One +** 
-log4j is an apache library used commonly in java applications. This particular issue was identified in +{{ :kb:3131789_-_mitigate_log4j_cve-2021-44228_vulnerability_in_sap_business_one.pdf |Download Mitigation Document}}** 
-log4j2 and fixed in log4j 2.15.0. +
-• +
-Environment +
-SAP Business One +
-Resolution +
-When using SAP Business One or SAP Business One, version for SAP HANA (version >= 9.3 PL07 +
-and <= 10.0 FP2108) and the component Workflow is installed, you can mitigate the vulnerability for +
-Workflow with the following procedure: +
-Go to directory C:\Program Files (x86)\SAP\SAP Business One ServerTools\Common\tomcat\bin, back +
-up tomcat8w.exe and then rename tomcat8w.exe to B1Workfloww.exe. +
-1. +
-Double-click B1Workfloww.exe to open SAP Business One Workflow Engine Properties form, go to the +
-Java tab, add the following content in Java Options and save +
-2. +
--Dlog4j2.formatMsgNoLookups=true +
-3. Rename B1Workfloww.exe back to tomcat8w.exe +
-4. Restart Workflow Engine Service from the windows services. +
-When using SAP Business One (version >= 10.0 FP 2008 and <= 10.0 FP 2108) and the component +
-License Server is installed, you can mitigate the vulnerability for License Server with the following +
-procedure: +
-Open the package C:\Program Files (x86)\SAP\SAP Business One +
-ServerTools\LicenseHTTPS\webapps\LicenseControlCenter.war in winrar(Right click +
-LicenseControlCenter.war and open it with winrar). +
-1. +
-Traverse to \WEB-INF\lib\log4j-core-2.7.jar and remove the JndiLookup class from the classpath: +
-org/apache/logging/log4j/core/lookup/JndiLookup.class. +
-2. +
-3. Accept the update archive. +
-© 2021 SAP SE or an SAP affiliate company. All rights reserved 1 of +
-4 +
-2021-12-16 3131789 +
-4. Restart the SAP Business One Server Tools Service from the windows services. +
-When using SAP Business One (version >= 10.0 FP 2008 and <= 10.0 FP 2108) and the component +
-Service Layer is installed, you can mitigate the vulnerability for Service Layer with the following +
-procedure: +
-Go to the 64-bit Server Tools installation folder (for example, C:\Program Files\SAP\SAP Business One +
-ServerTools). +
-1. +
-Navigate into the ServiceLayerController webapp folder: +
-.\ServiceLayer\ServiceLayerController\webapps +
-2. +
-3. Right click the ServiceLayerController.war and open it with winrar. +
-Traverse to WEB-INF\lib\log4j-core-2.7.jar, double-click it and you will see the folder structure of log4jcore-2.7.jar. +
-4. +
-Find the file JndiLookup.class from the class path: org/apache/logging/log4j/core/lookup and delete this +
-file. +
-5. +
-6. Accept the updated archive. +
-7. Restart the 64-bit SAP Business One Server Tools Service from the windows services. +
-When using SAP Business One (version >= 10.0 FP2102 and <= 10.0 FP2108) and the component Job +
-Service is installed, you can mitigate the vulnerability for Job Service with the following procedure: +
-Go to directory C:\Program Files (x86)\SAP\SAP Business One ServerTools\Common\tomcat\bin, back +
-up tomcat8w.exe and then rename tomcat8w.exe to B1ServerToolsw.exe +
-1. +
-Double-click B1ServerToolsw.exe to open SAP Business One Server Tools Service Properties form, +
-go to the Java tab, add the following content in Java Options and save +
-2. +
--Dlog4j2.formatMsgNoLookups=true +
-3. Rename B1ServerToolsw.exe back to tomcat8w.exe. +
-4. Restart SAP Business One Server Tools Service from the windows services. +
-When using SAP Business One (version >= 10.0 FP 2008 and <= 10.0 FP 2108) and the component +
-Extension Manager(SLD) is installed, you can mitigate the vulnerability for Extension Manager with +
-the following procedure: +
-Open the package C:\Program Files (x86)\SAP\SAP Business One +
-ServerTools\ExtensionManager\webapps\ExtensionManager.war in winrar (Right click +
-ExtensionManager.war and open it in winrar). +
-1. +
-Traverse to \WEB-INF\lib\log4j-core-2.7.jar and remove the JndiLookup class from the classpath: +
-org/apache/logging/log4j/core/lookup/JndiLookup.class. +
-2. +
-3. Accept the update archive. +
-4. Restart the SAP Business One Server Tools Service from the windows services. +
-When using SAP Business One, version for SAP HANA (version >= 10.0 FP 2008 and <= 10.0 FP 2108) +
-and the component License Server is installed, you can mitigate the vulnerability for License Server +
-with the following procedure: +
-1. Go to the server tools installation directory (for example, /usr/sap/SAPBusinessOne) +
-2. Navigate into the License’s webapps directory: +
-/usr/sap/SAPBusinessOne/ServerTools/License/webapps +
-Run the following command to remove the JndiLookup.class of log4j-core-2.7.jar from +
-LicenseControlCenter.war: +
-3. +
-© 2021 SAP SE or an SAP affiliate company. All rights reserved 2 of +
-4 +
-2021-12-16 3131789 +
-unzip LicenseControlCenter.war WEB-INF/lib/log4j-core-2.7.jar -d . +
-zip -q -d WEB-INF/lib/log4j-core-2.7.jar org/apache/logging/log4j/core/lookup/JndiLookup.class +
-zip LicenseControlCenter.war WEB-INF/lib/log4j-core-2.7.jar +
-rm -r WEB-INF +
-4. Restore the permission of LicenseControlCenter.war by running the following command: +
-chown b1service0:b1service0 LicenseControlCenter.war +
-5. Restart the server tools. +
-When using SAP Business One, version for SAP HANA (version >= 10.0 FP 2008 and <= 10.0 FP 2108) +
-and the component Service Layer is installed, you can mitigate the vulnerability for Service Layer +
-with the following procedure: +
-1. Go to the server tools installation directory (for example, /usr/sap/SAPBusinessOne) +
-2. Navigate into the ServiceLayer Controller's webapps directory: +
-/usr/sap/SAPBusinessOne/ServiceLayer/ServiceLayerController/webapps +
-Run the following command to remove the JndiLookup.class of log4j-core-2.7.jar from +
-ServiceLayerController.war: +
-3. +
-unzip ServiceLayerController.war WEB-INF/lib/log4j-core-2.7.jar -d . +
-zip -q -d WEB-INF/lib/log4j-core-2.7.jar org/apache/logging/log4j/core/lookup/JndiLookup.class +
-zip ServiceLayerController.war WEB-INF/lib/log4j-core-2.7.jar +
-rm -r WEB-INF +
-4. Restore the permission of ServiceLayerController.war by running the following command: +
-chown b1service0:b1service0 ServiceLayerController.war +
-5. Restart the server tools. +
-When using SAP Business One, version for SAP HANA (version >= 10.0 FP 2102 and <= 10.0 FP2108) +
-and the component Job Service is installed, you can mitigate the vulnerability for Job Service with +
-the following procedure: +
-1. Open file /etc/init.d/sapb1servertools. +
-2. Change the value of variable 'JAVA_OPTS', add a new option as follows: +
-JAVA_OPTS="$JAVA_OPTS -Duser.country=US -Duser.language=en -Dfile.encoding=UTF-8 - +
-Djava.awt.headless=true -server -Xms1024m -Xmx5120M -XX:MetaspaceSize=128m - +
-XX:MaxMetaspaceSize=512m -Dlog4j2.formatMsgNoLookups=true" +
-2. Save and close the file. +
-3. Restart the server tools. +
-When using SAP Business One, version for SAP HANA (version >= 10.0 FP 2008 and <= 10.0 FP 2108) +
-and the component Extension Manager(SLD) is installed, you can mitigate the vulnerability for +
-Extension Manager with the following procedure: +
-1. Go to the server tools installation directory (for example, /usr/sap/SAPBusinessOne) +
-2. Navigate into the ExtensionManager's webapps directory: +
-/usr/sap/SAPBusinessOne/ServerTools/ExtensionManager/webapps +
-© 2021 SAP SE or an SAP affiliate company. All rights reserved 3 of +
-4 +
-2021-12-16 3131789 +
-Run the following command to remove the JndiLookup.class of log4j-core-2.7.jar from +
-ExtensionManager.war: +
-3. +
-unzip ExtensionManager.war WEB-INF/lib/log4j-core-2.7.jar -d . +
-zip -q -d WEB-INF/lib/log4j-core-2.7.jar org/apache/logging/log4j/core/lookup/JndiLookup.class +
-zip ExtensionManager.war WEB-INF/lib/log4j-core-2.7.jar +
-rm -r WEB-INF +
-4. Restore the permission of ExtensionManager.war by running the following command: +
-chown b1service0:b1service0 ExtensionManager.war +
-5. Restart the server tools. +
-When SAP Business One Integration Framework (B1 10.0 FP2105, and B1 10.0 FP2108) is installed, +
-the vulnerability for Integration Framework can be mitigated with the following procedure: +
-Option 1: Switch off the execution of the Crystal Reports in the integration framework: +
-1. Go to %InstallationDir%\IntegrationServer\Tomcat\IntegrationServer\Tomcat\webapps\B1iXcellerator. +
-2. Edit the xcellerator.cfg file, and change xcl.reporting=false. +
-3. Restart the Tomcat or Integration Service. +
-Side effect: The reporting processing functionality will be disabled. +
-Option 2: Add JVM Args to disable Msg Lookups: +
-1. Go to %InstallationDir%\IntegrationServer\Tomcat\bin folder. +
-2. Execute tomcat8w.exe. +
-3. Go to the Java tab. +
-4. Add -Dlog4j2.formatMsgNoLookups=true to the Java options. +
-5. Restart the Tomcat or Integration Service. +
-See Also +
-• https://nvd.nist.gov/vuln/detail/CVE-2021-44228 +
-Keywords +
-Log4J, CVE-2021-44228, B1, vulnerability, bug +
-Products +
-SAP Business One 10.0 +
-SAP Business One 10.0, version for SAP HANA +
-SAP Business One 9.3 +
-SAP Business One 9.3, version for SAP HANA +
-Terms of use | Copyright | Trademark | Legal Disclosure | Privacy +
-© 2021 SAP SE or an SAP affiliate company. All rights reserved 4 of +
-4+
kb/kb_item_364.1639672746.txt.gz · Last modified: 2021/12/16 11:39 by mneuendorff

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial 4.0 International
CC Attribution-Noncommercial 4.0 International Valid HTML5 Valid CSS Driven by DokuWiki