NewsUpdate on security vulnerability in Log4j in combination with IBM Spectrum Protect and Spectrum Protect Plus

Markus Stumpf — 06. January 2022
Reading time: 02:03 minutes

Update zu Sicherheitslücke in Log4j in Verbindung mit IBM Spectrum Protect und Spectrum Protect Plus

As reported in several articles in December, Spectrum Protect and Spectrum Protect Plus are only affected by the security vulnerabilities related to Log4j 2.X in individual web components. This article describes the current workarounds and patches for the affected components.

Backup Archive Client

First of all, it should be clarified again that older versions of Spectrum Protect that distribute Log4j 1.X in the binaries are not affected by these vulnerabilities, because the attack in the context of CVE-2021-44228 is only possible with Log4j version 2.0 and higher.

Nevertheless, Log4j is included in every Backup/Archive client package as binaries, and we still receive many customer inquiries about how to handle these packages as a result.

The simplest fix is still to replace the Log4j files from the installation directories, with the latest version of Log4j 2.17.1.

Yesterday IBM released an update for the Backup/Archive clients to version 8.13.2. However, this update "only" includes Log4j 2.17.0, so this version is still vulnerable via CVE-2021-44832. However, this vulnerability requires local access to the Log4j config file. Thus, this vulnerability is not comparable to CVE 2021-44228.

The other relevant CVEs CVE-2021-45105, CVE-2021-45046 and CVE 2021-44228 have already been fixed with Backup/Archive Client 8.1.13.1.

Download Backup/Archive Client 8.1.13.2

Download Data Protection for Virtual Environments VMWare 8.1.13.2

Operations Center

The Operations Center uses Log4j and is therefore also affected by all CVEs. Here you can also replace the Log4j files with the latest version 2.17.1. How to replace the files is described in the following Security Bulletin under "Workarounds and Mitigations":

Download Operations Center 8.1.13.200:
http://ftp.software.ibm.com/storage/tivoli-storage-management/patches/opcenter/8.1.13.200/

Spectrum Protect Plus

Security Bulletins have also been published for Spectrum Protect Plus. Here is the current latest fix version 10.1.9.2.

Download Spectrum Protect Plus 10.1.9.2
https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Spectrum%20Protect%20family&product=ibm/StorageSoftware/IBM+Spectrum+Protect+Plus&release=All&platform=All&function=all

Further Links

We wish you continued safe times in the new year.

Your Empalis-Team

Markus Stumpf

Markus Stumpf

Markus Stumpf is Head of Data Protection Services and Business Development Manager at Empalis Consulting GmbH.
As an expert in data protection solutions such as IBM Spectrum Protect, Veeam or Cohesity and with over 20 years of experience in implementation, operation and training (especially with IBM Spectrum Protect), he is happy to answer all your questions.

You were interested in this, then you may also be interested in...