Apache Log4J Zero Day Vulnerability Update – 20/12/2021

What we are doing  

Six Degrees CSOC (Cyber Security Operations Centre) are continually monitoring threat intelligence sources for Apache Log4j vulnerability developments and our Threat Response Team are closely reviewing vendor statements as they are released.  

We are reacting to vendor statements where workarounds, patching and updates have been advised. Where downtime is required, customers have been and will be contacted directly to organise a mitigation action plan. 

What we have done 

• We have completed our review of over 250 technologies to assess their vulnerability to the Log4J threat.
• Key areas impacted include our Enterprise Cloud Platform (VMWare) and Avaya unified communication
• Enterprise Cloud  
  • We have completed the first workaround released by VMWare in relation CVE-2021-44228. *
  • We are actively rolling out the second VMWare workaround in relation to CVE-2021-45046. *
  • We are currently awaiting VMWare’s response to CVE-2021-45105 raised on 17th December. As soon as a workaround or full patch is released, we will be ready to deploy, including over the Christmas period.
    * The Enterprise Cloud workarounds have been completed without notification as they have not required downtime.
• Avaya Unified Communication  
  • All relevant Avaya clients have had mitigation applied against the Log4j vulnerability 
  • We have reached out to our clients to arrange downtime to implement the mitigation that Avaya released on the 17th December 
  • We have contacted all customers that require a maintenance window to ensure we manage the service impact when implementing mitigation.

What you can do  

• We would be grateful if you would support us in responding rapidly to our communications to ensure we can offer you protection in line with vendor advice prior to the Christmas break where possible, including providing emergency contacts for the holiday period. 
• Review your entire estate (not just Six Degrees managed) using this list to ascertain if you have vulnerabilities  
  https://github.com/NCSC-NL/log4shell/blob/main/software/README.md#m 
• Where you have relationships with vendors, monitor their statements and act accordingly to their recommendations 
• Act on our technical Apache vulnerability advice below 
• Keep up to date with Six Degrees progress via our information hub

What’s next 

We will continue to monitor the situation and provide updates via our Information hub. 
Our technical teams across all our products are working tirelessly to continue apply vendor solutions to this potential threat. 
We are pushing forwards with our response to this vulnerability and will continue to provide updates via our information hub.