Good Day everyone. In this section we will be covering the workaround steps for
Appliance Configuration Manager or ACM to fix the Apache Log4j remote code execution vulnerability.
As part of the agenda we'll go through the prerequisite steps.
We'll go through the actual steps required to work around this issue on ACM,
and additionally users can also refer to the Dell EMC knowledge base article 194520
to fetch these steps. In the prerequisites section user must log into the ACM UI by entering the URL
https://:8543, click on the PDF icon in the top right corner to download the PDF,
open the dataprotectionconfiguration.pdf to fetch the component IP addresses and their versions.
It's very important to note the versions of the IDPA as well as the point products.
Alternately users can grab the IP addresses and version details from ACM UI dashboards as well.
In this section it is important to note the IP address and the version of ACM to proceed further.
While applying the workaround please be aware the following workaround must only be applied
on PowerProtect DP series appliance in IDPA version 2.7. ACM in PowerProtect DP series
appliance and IDPA versions 2.6 dot x and below are not impacted by this cve 2021-4428.
The steps are as follows: Open the SSH to ACM and login as root user. In the file
/etc/init.d/dataprotection_webapp in the start function we need to comment the two lines that are
shown below. You can see the before and after, how it looks once it's commented out. Once this change
is done we need to save the file, and once the file has been saved we need to change the
directory to the apache tomcat lib directory as shown here. Now run the zip command to remove the
vulnerable class JndiLookup from log4j-core jar using the command provided in step 5. In step 6 we
restart the ACM Webapp service using the following commands. Please note that the steps performed in
number three need to be commented out if you know the PowerProtect DP series appliance or IDP
upgrade needs to happen, so definitely undo those steps that are mentioned in step three before
performing any PowerProtect DP appliance or IDPA upgrade or patch. Now let's go through the demo.
Open a PuTTY session to the ACM server
and once you've opened PuTTY then vi into the /edc/init.d file.
Once we type the vi command hit enter and that should get you inside the file. Now the two
lines that need to be commented out are right after the start function as mentioned in the kb
article. The lines start with 'rm-r' and the two lines are the ones that are highlighted here.
So in order to comment these press 'i' on your keyboard to enter insert mode
and then the two lines that need to be commented just press hash key and you will notice the file
or the line becomes blue in colour. Once the two lines have been commented out
press escape key and then colon wq and exclamation mark to save the file.
Now change directory to the apache lib directory, you can do that using this command,
cd command. Once you have changed the directory then run the zip command,
and once the zip command has been run then run service data protection web app stop and start.
And once the service has been started, this point the remediation steps on ACM have completed.
And that completes this section training thank you