九游老哥云
【威胁通告】VMware 多个产品保存?Log4j2远程代码执行误差（CVE-2021-44228）通告
2021-12-14
一. 误差概述
克日，九游老哥科技CERT监测到VMware 宣布清静通告，VMware的众多产品受Apache Log4j2远程代码执行误差（CVE-2021-44228）的影响。由于Apache Log4j2某些功效保存递归剖析功效，未经身份验证的攻击者通过发送特殊结构的数据请求包，可在受影响的 VMware 产品中执行恣意代码。误差PoC已果真，且发明在野使用，建议相关用户尽快接纳步伐举行排查与防护。
参考链接：
https://www.vmware.com/security/advisories/VMSA-2021-0028.html
二. 影响规模
受影响产品（更新中）：
VMware Horizon
VMware vCenter Server
VMware HCX
VMware NSX-T Data Center
VMware Unified Access Gateway
VMware WorkspaceOne Access
VMware Identity Manager
VMware vRealize Operations
VMware vRealize Operations Cloud Proxy
VMware vRealize Log Insight
VMware vRealize Automation
VMware vRealize Lifecycle Manager
VMware Telco Cloud Automation
VMware Site Recovery Manager, vSphere Replication
VMware Carbon Black Cloud Workload Appliance
VMware Carbon Black EDR Server
VMware Tanzu GemFire
VMware Tanzu Greenplum
VMware Tanzu Operations Manager
VMware Tanzu Application Service for VMs
VMware Tanzu Kubernetes Grid Integrated Edition
VMware Tanzu Observability by Wavefront Nozzle
Healthwatch for Tanzu Application Service
Spring Cloud Services for VMware Tanzu
Spring Cloud Gateway for VMware Tanzu
Spring Cloud Gateway for Kubernetes
API Portal for VMware Tanzu
Single Sign-On for VMware Tanzu Application Service
App Metrics
VMware vCenter Cloud Gateway
VMware Tanzu SQL with MySQL for VMs
VMware vRealize Orchestrator
VMware Cloud Foundation
VMware Workspace ONE Access Connector
VMware Horizon DaaS
VMware Horizon Cloud Connector
VMware NSX Data Center for vSphere
VMware AppDefense Appliance
不受影响产品（更新中）：
VMware vSphere ESXi
VMware vCloud Director
VMware vCloud Availability
VMware NSX Advanced Load Balancer (Avi)
VMware Software-Defined WAN (SD-WAN)
VMware Workspace ONE Assist
VMware RemoteHelp
VMware vCloud Usage Meter
VMware Tanzu Scheduler
VMware Tanzu Kubernetes Grid
SaltStack
参考链接：https://kb.vmware.com/s/article/87068
三. 误差防护
3.1 官方升级
现在官方已针对以下产品宣布了新版本修复该误差，请受影响的用户尽快升级版本举行防护，对应产品版本的下载链接及文档如下：
|
产品版本 |
下载链接 |
操作文档 |
|
VMware Tanzu Operations Manager href="https://network.pivotal.io/products/ops-manager/" 2.10.23 |
https://network.pivotal.io/products/ops-manager/ |
https://docs.pivotal.io/ops-manager/2-10/release-notes.html#2-10-23 |
|
VMware Tanzu Application Service 2.12.3、2.11.10、2.10.22、2.7.42 |
https://network.pivotal.io/products/elastic-runtime |
https://docs.pivotal.io/application-service/2-12/release-notes/runtime-rn.html#2.12.3 https://docs.pivotal.io/application-service/2-11/release-notes/runtime-rn.html#2.11.10 https://docs.pivotal.io/application-service/2-10/release-notes/runtime-rn.html#2.10.22 https://docs.pivotal.io/application-service/2-7/release-notes/runtime-rn.html#2.7.42) |
|
VMware Tanzu Observability by Wavefront Nozzle href="https://network.pivotal.io/products/wavefront-nozzle" 3.0.3 |
https://network.pivotal.io/products/wavefront-nozzle |
|
|
Healthwatch for Tanzu Application Service href="https://network.pivotal.io/products/p-healthwatch" 2.1.7, 1.8.6 |
https://network.pivotal.io/products/p-healthwatch |
|
|
App Metrics href="https://network.pivotal.io/products/apm" 2.1.1 |
https://network.pivotal.io/products/apm |
|
|
VMware Horizon Cloud Connector href="#product_downloads" 2.1.1 |
https://customerconnect.vmware.com/downloads/details?downloadGroup=HCS-CC-210&productId=716&rPId=79131#product_downloads |
|
|
VMware Carbon Black EDR Server 7.6.0 |
https://community.carbonblack.com/t5/Endpoint-Detection-and-Response/VMware-Carbon-Black-EDR-Announcing-General-Availability-of-EDR/td-p/109189 |
|
三.2 暂时防护步伐：
1.若营业情形允许，可使用白名单限制web端口会见方法来降低危害
2.客户可凭证自身产品团结下列参考链接接纳暂时防护。
|
产品版本 |
参考链接 |
|
VMware Horizon 8.x, 7.x |
https://kb.vmware.com/s/article/87073 |
|
VMware vCenter Server 7.x, 6.x |
https://kb.vmware.com/s/article/87081?lang=en_US |
|
VMware HCX 4.x, 3.x |
https://kb.vmware.com/s/article/86169 |
|
VMware NSX-T Data Center 3.x, 2.x |
https://kb.vmware.com/s/article/87086 |
|
VMware Unified Access Gateway 21.x, 20.x, 3.x |
https://kb.vmware.com/s/article/87092 |
|
VMware Workspace ONE Access 21.x, 20.10.x |
https://kb.vmware.com/s/article/87090 |
|
VMware Identity Manager 3.3.x |
https://kb.vmware.com/s/article/87093 |
|
VMware vRealize Operations 8.x |
https://kb.vmware.com/s/article/87076 |
|
VMware vRealize Operations Cloud Proxy Any |
https://kb.vmware.com/s/article/87080 |
|
VMware vRealize Log Insight 8.x |
https://kb.vmware.com/s/article/87089?lang=en_US |
|
VMware Carbon Black Cloud Workload Appliance 1.x |
https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-VMware-Carbon-Black-Cloud/ta-p/109167 |
|
VMware Carbon Black EDR Server 7.x, 6.x |
https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-VMware-Carbon-Black-EDR/ta-p/109168 |
|
VMware Tanzu GemFire 9.x, 8.x |
https://community.pivotal.io/s/article/Workaround-to-address-CVE-2021-44228-Apache-Log4j-Remote-Code-Execution-for-all-GemFire-versions?language=en_US |
|
VMware Tanzu Greenplum 6.x |
https://community.pivotal.io/s/article/Workaround-to-address-CVE-2021-44228-Apache-Log4j-Remote-Code-Execution-for-All-Greenplum-Versions?language=en_US |
|
VMware Tanzu Operations Manager 2.x |
https://community.pivotal.io/s/article/5004y00001mPn2N1639255611105?language=en_US |
|
VMware Tanzu Application Service for VMs 2.x |
https://community.pivotal.io/s/article/Workaround-instructions-to-address-CVE-2021-44228-in-Tanzu-Application-Service-2-7-through-2-12?language=en_US |
|
VMware Tanzu Kubernetes Grid Integrated Edition 1.x |
https://community.pivotal.io/s/article/Workaround-instructions-to-address-CVE-2021-44228-in-Tanzu-Kubernetes-Grid-Integrated?language=en_US |
|
VMware Cloud Foundation4.x, 3.x |
https://kb.vmware.com/s/article/87095 |
|
VMware Workspace ONE Access Connector (VMware Identity Manager Connector) 21.x, 20.10.x, 19.03.0.1 |
https://kb.vmware.com/s/article/87091 |
|
VMware Horizon DaaS 9.1.x, 9.0.x |
https://kb.vmware.com/s/article/87101 |
|
VMware NSX Data Center for vSphere |
https://kb.vmware.com/s/article/87099 |
|
VMware AppDefense Appliance |
https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-AppDefense/ta-p/109180 |
声明
本清静通告仅用来形貌可能保存的清静问题，九游老哥科技不为此清静通告提供任何包管或允许。由于撒播、使用此清静通告所提供的信息而造成的任何直接或者间接的效果及损失，均由使用者自己认真，九游老哥科技以及清静通告作者不为此肩负任何责任。
九游老哥科技拥有对此清静通告的修改息争释权。如欲转载或撒播此清静通告，必需包管此清静通告的完整性，包括版权声明等所有内容。未经九游老哥科技允许，不得恣意修改或者增减此清静通告内容，不得以任何方法将其用于商业目的。
