topic Re: Log4j CVE-2021-45105 e CVE-2021-4104 Not Found basedNow IPS in General Topics

Log4j CVE-2021-45105 e CVE-2021-4104 Not Found basedNow IPS

Paulo_Feitosa — Wed, 29 Dec 2021 11:11:10 GMT

Guys,

I'm trying to update and find the CVE-2021-45105 e CVE-2021-4104 in my IPS checkpoint.

Looks like it hasn't been released yet.

Note: And I say IPS signature trheat prevention.

Re: Log4j CVE-2021-45105 e CVE-2021-4104 Not Found basedNow IPS

_Val_ — Wed, 29 Dec 2021 11:21:47 GMT

CVE-2021-45105 is included into CPAI-2021-0955 on December 21: https://www.checkpoint.com/defense/advisories/public/2021/cpai-2021-0955.html

CVE-2021-4104 is about vulnerability in the product that was EOL in 2015. Are you sure you did not mistype it?

Re: Log4j CVE-2021-45105 e CVE-2021-4104 Not Found basedNow IPS

Paulo_Feitosa — Wed, 29 Dec 2021 14:00:02 GMT

I meant the cves below:
CVE - CVE-2021-44832 (mitre.org)
CVE - CVE-2021-4104 (mitre.org)

Not found in my IPS basednow

Re: Log4j CVE-2021-45105 e CVE-2021-4104 Not Found basedNow IPS

_Val_ — Wed, 29 Dec 2021 14:00:46 GMT

You can make an official enquiry through a TAC ticket.

Re: Log4j CVE-2021-45105 e CVE-2021-4104 Not Found basedNow IPS

_Val_ — Wed, 29 Dec 2021 16:01:50 GMT

In addition, here is a reply from our experts, quoting:

CVE-2021-4104: This CVE contains a local attack vector, and therefore will not be detected in traffic as the known attack vector of Log4j - so it can't be covered by IPS.

Also, notice that it is only affecting Log4j 1.2 that reached the end of life more than 6 years ago.

CVE-2021-44832: We will consult with the IPS team if it is possible to cover it although it also uses a local attack vector.
We will update you as soon as we receive their response.