Advisory

Computronix Advisory on Log4Shell (CVE-2021-44228)

Since the details of this vulnerability were published, Computronix has reviewed our internal infrastructure, shipping code, and procedures for installation in client environments.

Based on this analysis, Computronix does not believe this to have a significant impact on Computronix or our clients. There are a number of reasons for this position including:

1. 1. No use of Java is made in currently shipping Computronix products (POSSE, POSSE ABC, POSSE PLS, POSSE Mobile, POSSE ePlans).

1. 1. Computronix installation instructions do not require Java to be installed on any client machine (desktop or server).

1. 1. No use of Java is made from within the Oracle database.

1. 1. POSSE does not support Java-based web servers or application servers (e.g., Tomcat, Jetty, Oracle WebLogic, JBoss).

1. 1. POSSE ePlans Cloud does use a third-party Java application. Vendor was engaged to provide guidance on this vulnerability. Vendor confirmed that Log4J is not utilized in any way. Regardless, mitigations have been put in place – note, the Java application is not exposed outside of the internal POSSE ePlans Cloud infrastructure.

1. 1. While Computronix uses some third-party services (like Atlassian’s Jira and Atlassian’s BitBucket) that use Java and may be affected by CVS-2021-44228, these services:
      1. 1. Do not have access to any client data

       

      1. 1. Do not require Log4J to be installed on any system accessing them

       

      1. 1. Are accessed only by a web-based  interface

       

Computronix has been in contact with those providers and, if required, will be implementing mitigations and/or updates as soon as they are available.

1. The initial installation of the Oracle database software includes and requires Java. In addition, when a new database is created, Oracle may create a website for management of the database (Oracle Enterprise Manager Database Express).
   1. 1. If Computronix creates the database, our procedure is to disable this website.

    

   1. 1. This website is not exposed externally. This means that an attacker would need to breach your environment before attempting to exploit this vulnerability.

    

Given these findings, Computronix is recommending that clients take the following actions:

1. 1. Update any Java-based third-party tools that access the POSSE databases.

1. 1. Verify that any third-party site you interface to (e.g., payment processor, accounting system) has addressed this vulnerability.

1. 1. If you are running Oracle in your datacenter and you are using Oracle Enterprise Manager, either restrict access to the website via IP, or upgrade Oracle Enterprise Manager.

NOTE: Oracle Enterprise Manager is a designation for multiple products, such as Enterprise Manager Cloud Control, Enterprise Manager Express, and Enterprise Manager Database Express.

If you have any questions, please contact either:

• Rich Isaac
  rich.isaac@test.computronix.com
  IT Manager
• Don Reid
  don.reid@test.computronix.com
  Security Officer

Author

Lee Ferris

Website

• Lee Ferris

  https://www.test.computronix.com/author/leefer/

  More Key Outcomes from a Successful Permitting System Modernization
• Lee Ferris

  https://www.test.computronix.com/author/leefer/

  Escalating Fines an Early Warning Sign for Gambling Regulators
• Lee Ferris

  https://www.test.computronix.com/author/leefer/

  The Key Outcomes From a Successful Permitting System Modernization
• Lee Ferris

  https://www.test.computronix.com/author/leefer/

  Will AI Make Gambling Safer or More Addictive?