article CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager in Official Support Articles

CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Jamie_Gregory — Tue, 25 Jan 2022 12:48:24 GMT

Qlik is providing these mitigation steps as a temporary measure. A patch will be provided and linked here; customers are advised to move to the patch as soon as it is available.

Patches are available. See Vulnerability Testing - Apache Log4j, reference CVE-2021-44228 (also referred to as Log4Shell) for your release and the relevant patch.

Upgrade at the earliest.

Environment:

Mitigation steps to follow Enterprise Manager log4j vulnerability:

Stop the Enterprise Manager service.
Edit the file <installation-root>\Enterprise Manager\java\bin\atajs.bat (<installation-root> typically refers to "C:\Program Files\Attunity")

Add the string ‐Dlog4j2.formatMsgNoLookups=true in the location shown below (last line of script):

@Echo off
REM attunity trend analysis java server configuration/run script

REM e.g. AT_PROD = C:\Program Files\Attunity\Enterprise Manager\java_server
for %%A in ("%~dp0..") do set AT_PROD=%%~fA

REM list plugins here
SET AT_PLUGIN_LIST=-plugins analytics_ctl

REM set data directory based on the name of this script
set AT_DATA_SUFFIX=
for /F "tokens=2 delims=_" %%A in ("%~n0") do set AT_DATA_SUFFIX=%%A

if "%AT_DATA_SUFFIX%" == "" (
    set AT_DATA=
) else (
    set AT_DATA=-d data_%AT_DATA_SUFFIX%
)

SET AT_ANALYTICS=%AT_PROD%\lib\jvm\bin\aemanalytics.exe
SET AT_EXTERNAL=%AT_PROD%\external
SET AT_LIB=%AT_PROD%\lib
SET AT_INFRA_JAR=%AT_LIB%\attunity.infrastructure.jar
SET AT_PLUGINS=%AT_PROD%\plugins
SET AT_MAIN=com.attunity.infrastructure.server.PluginServer

REM                                                           <-------------- Fix Here ------------>
"%AT_ANALYTICS%" %JAVA_LIB_PATH%  ‐Dlog4j2.formatMsgNoLookups=true -cp "%AT_INFRA_JAR%";"%AT_PLUGINS%"/*;"%AT_EXTERNAL%"/*;"%AT_LIB%"/* %AT_MAIN% %AT_DATA% %AT_PLUGIN_LIST% %*

Save the file.
Locate the vulnerable log4j-core-<version#>.jar file and rename/move it to ../log4j-core-<version#>.jar-vulnerable.
$ cd <installation-root>\Enterprise Manager\java\external $ ren log4j-core-<version#>.jar ..\log4j-core-<version#>.jar-vulnerable
Download the non-vulnerable jar named log4j-core-nolookup-<version#>.jar from this page and place it in the same location as the vulnerable jar.

Restart the Enterprise Manager Windows service.

$ sc stop AttunityEnterpriseManager

$ sc start AttunityEnterpriseManager

Note that if you have a customized Enterprise Manager start script, you should perform the equivalent edit on your modified start script.

For more information on the Log4j vulnerability, please visit the Support Updates Blog post.

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Jon_Donker — Mon, 13 Dec 2021 23:35:41 GMT

Hi - Thanks for the mitigation steps.

Does this impact the functionality of Enterprise manager in any way?

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

GerardQ — Fri, 17 Dec 2021 12:05:48 GMT

I found the Analytics service no longer works:

SYS,GENERAL_EXCEPTION,Unable to connect to the remote server

In log file:

[Manager ] [ERROR] The Analytics java server could not start.

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Antony_05 — Tue, 21 Dec 2021 08:08:40 GMT

Hi Team,

Please let us know the whether the newly updated mitigation for QEM is working fine or not.?

Thanks,

Antony S

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

GerardQ — Tue, 21 Dec 2021 10:17:30 GMT

@Anthony, the issue with Analytics service was caused by the minus sign character in the adviced remediation pages. I used copy/paste to add the parameter to the JVM and that caused the error. The issue was resolved after manually typing '-'-sign.

Regards, Gerard

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Antony_05 — Tue, 21 Dec 2021 10:59:04 GMT

Hi,

I'm getting an error while renaming the log4j.jar file in the QEM.

ren log4j-core-2.11.1.jar log4j-core-2.11.1.jar-vulnerable

ERROR:
The process cannot access the file because it is being used by another process.

Thanks,

Antony S

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

GerardQ — Tue, 21 Dec 2021 12:08:46 GMT

Did you stop the service first?

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Antony_05 — Tue, 21 Dec 2021 14:44:46 GMT

Hi,

No we did not stop the service first ,we followed the steps as its give in this community. Renaming the Log4j . jar file first when we got this error.Should we stop the Replication first and then rename the jar file followed by replacing it with the new version of jar file provided and then start the Replication again ?

Thanks

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

ChadW — Tue, 21 Dec 2021 14:55:34 GMT

@GerardQ We also are getting the SYS,GENERAL_EXCEPTION,Unable to connect to the remote server error. We tried editing the file and typing in the "-", stopped and started the services again, but still get that same error

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

GerardQ — Tue, 21 Dec 2021 14:56:22 GMT

Yes you need to stop the service first.

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

ChadW — Tue, 21 Dec 2021 19:45:43 GMT

We had to apply 2021.5 SR4 for it to work

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Steve_Nguyen — Tue, 21 Dec 2021 22:25:55 GMT

group:

1. you would need to stop the QEM service first.
2. when download the log4j-core-nolookup-<version#>.jar , make sure that you use the correct version that you rename .
3. then you would need to start the QEM service after replacing the log4j-core-nolookup-<version#>.jar file.

i tested on 7.7 sp9 ( 7.0.0.1566 ) without any issue.

and 2021.5 sp8 (2021.5.0.498) without any issue.

NOTES: that if you were on 7.7xx and already apply the nolookup jar file . then you upgrade to 2021.5xx kit. you would need to redo all the steps again.

Re: CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik Enterprise Manager

Antony_05 — Wed, 22 Dec 2021 06:48:02 GMT

Hi,

As you mentioned, I tried the full process again after stopping the QEM service. But I'm facing the same error.

ERROR:
The process cannot access the file because it is being used by another process.

And the QEM version that I'm using is (Version 7.0.0.461)

Thanks,
Antony S