CSCwa47133 - Evaluation log4j CVE-2021-44228

[Evelyn Riha]

Are there any checks or verifications known to see if ISE was not infiltrated by someone using log4j?

[Kasun Bandara]

Hi,

According to advisory, more details are yet to release. meanwhile check it below.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd?emailclick=CNSemail

[sacristiano]

Hi, in addition:

Which internal network hosts can exploit Cisco ISE? Any server? Or through some server that has a relationship of trust with it, but that has been compromised?

Thanks!

[Kasun Bandara]

Hi,

This vulnerability makes it available for any user. anyone who have exploit can attack.

[Leo Laohoo]

Patch can be found HERE.  

Release Notes (for the patch) can be found HERE.

NOTE:  Patch only apply to ISE 2.4, 2.6, 2.7 or 3.0.

[AkshayKPIT8727]

Thanks !!

[AnilKumar95946]

Hi,

Do all the ISE services will be restarted as a result of this hotfix installation? Do we require a downtime to install this hotfix?. 

[lisacoody]

Great question. Following this thread for an answer.

[Mats Nilson]

The server will not restart, but services will, so there will definitely be some downtime:

I got this advice from TAC:

Please keep in mind that installing the hotpatch will cause a restart of the ISE services, so you will need to do it in a maintenance window after working hours to avoid any network down situation.

Hope this answers your questions

[lisacoody]

Thanks Mats! I appreciate the information!

[AnilKumar95946]

Thanks Mats

Got the same response from TAC.

[andrew_cooper]

Also would like to know if downtime will be required.  I have never installed a "hotpatch" for ISE nor loaded any patch via CLI.  Cannot find any documentation on an ISE hotpatch

[Mats Nilson]

Andrew.

Please se above:

//Mats

[AnilKumar95946]

Hey Guys,

Anybody successfully installed the Hotfix yet. When i am installing giving me error "% Unable to unbundle the package. It should be in tar.gz file format". I am doing it correctly using command 

application install ise-apply-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz <Repository_Name>

[lisacoody]

I haven't installed the patch yet (I'll do that tonight). There's some helpful notes here https://community.cisco.com/t5/network-access-control/ise-2-7-0-356/m-p/4519950#M571744