CSCwa47133 - Evaluation log4j CVE-2021-44228

[Evelyn Riha]

Are there any checks or verifications known to see if ISE was not infiltrated by someone using log4j?

[othydojo]

@AnilKumar95946 

I was encountering the same issue. Turns out when I first downloaded the file it was 20KB, tried again it was 5KB. It could be that the hot-fix that was downloaded was corrupted somehow. Re-download the hot-fix and try again, that worked for me.

[Gwendolyn Lapasky]

Hello -

We successfully applied the hot fix ise-apply-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz  to our ISE nodes last night.

Our Risk Management team is asking for the version of log4j that is now installed.

Can you please verify what version we're now running?

[Tobias Moritz]

@Gwendolyn Lapasky: The hotfix ise-apply-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz does not change the log4j version. The developers just removed the JndiLookup.class from the jar file.

[Leo Laohoo]

ISE 3.1 patch 1 can be found HERE.

ISE 3.1 patch 1 Release Notes can be found HERE.

NOTE:  Applying patch 1 will restart the services.  

[access.cs1]

Still no guidelines to verify for exploit ?