Is configutil susceptible for the CVE-2021-44228 (Log4j) Security vulnerability? - Progress Community

Loading

Skip to Main Content

Is configutil susceptible for the CVE-2021-44228 (Log4j) Security vulnerability?

What is the Configutil tool ? What is the import-export utility ? Is configutil used by any component in the OpenEge installation ? Is configutil susceptible for the CVE-2021-44228 (Log4j) Security vulnerability ?

Dec 16, 2021
Knowledge

Title

Is configutil susceptible for the CVE-2021-44228 (Log4j) Security vulnerability?

URL Name

Is-configutil-susceptible-for-the-CVE-2021-44228-Log4j-Security-vulnerability

Article Number

000207290

Environment

Product: OpenEdge Version: 11.7.11 OS: All supported platforms Other: Log4j

Question/Problem Description

What is the Configutil tool ?
What is the import-export utility ?
Is configutil used by any component in the OpenEge installation ?
Is configutil susceptible for the CVE-2021-44228 (Log4j) Security vulnerability ?

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

Enhancement Number

Cause

Resolution

OpenEdge import-export utility is a Configutil.
This utility allows you to capture the customized configuration changes from OpenEdge installation and preserve them so that they can be applied to a different OpenEdge installation.
This process of capturing the existing configuration setting is referred to as the export operation. This process creates a zip file named export<timestamp>.zip.
https://docs.progress.com/bundle/openedge-install-117/page/Configutil-Operations.html

Configutil is a command line tool and is out of the box not used by any OpenEdge component.
The configutil should not be made accessible to remote users or through any port of a public-facing OpenEdge web application.

The OpenEdge 11.7.11 configutil should not be made accessible remote users or through any port of a public-facing OpenEdge web application.

The OpenEdge 11.7.11 Configutil uses the following log4j files :
DLC/install/configbackup/log4j-core-2.14.1.jar
DLC/install/configbackup/log4j-api-2.14.1.jar

Refer to Article 000207330 Steps to upgrade log4j2 to 2.17.0 jars in OpenEdge 11.7.11 for instructions on how to upgrade configutil on your system to replace vulnerable log4j version 2 jars.
Optionally if this tool is not used these jar files could be removed, which would render the utility unusable.
The configutil tool would be subject to exploit if any of its command input were capable of causing log4j to deliver a string formatted to perform a JNDI message lookup that deserialized remote code during the tool’s execution.

A regular user without elevated privileges might not be able to cause significant harm executing remote code without significant local authority. However, even if sensitive local resources are protected, remote code can damage the system through DOS attacks that can render system resources unavailable.

There is no way to be certain how any system resources made available to remote code execution might choose to exploit a system. The best course of action is to ensure no remote or unauthorized access to the configutil tool is possible and that the log4j jars used by the tool are updated as soon as possible to eliminate known vulnerabilities.

Refer to Article 000207330 Steps to upgrade log4j2 to 2.17.0 jars in OpenEdge 11.7.11 for locate instructions on how to perform upgrades to the vulnerable log4j version 2 jar files used by the OE 11.7.11 configutil command.

Workaround

Notes

Reference to other documentation:
Progress Article(s):
000207330 Steps to upgrade log4j2 to 2.17.0 jars in OpenEdge 11.7.11

Progress Information Hub -> OpenEdge® Getting Started -> Installation and Configuration -> Command and Utility Reference -> Managing installation configurations -> configutil -> Configutil Operations:
https://docs.progress.com/bundle/openedge-install-117/page/Configutil-Operations.html

Keyword Phrase

Last Modified Date

1/14/2022 3:41 PM

OpenEdge DeploymentOpenEdge ArchitectureOpenEdge DevelopmentOpenEdge General DiscussionsOpenEdge Pro2OpenEdge RDBMS

Drop Files

Upload FilesOr drop files

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Loading

Is configutil susceptible for the CVE-2021-44228 (Log4j) Security vulnerability? - Progress Community