QID 376231

Date Published: 2022-01-13

QID 376231: Dell EMC NetWorker Server Apache Log4j multiple Remote Code Execution (RCE) Vulnerabilities (DSA-2021-280)

Dell EMC NetWorker is a suite of enterprise level data protection software that unifies and automates backup to tape, disk-based, and flash-based storage media across physical and virtual environments for granular and disaster recovery.

Affected Version:
Dell EMC NetWorker Server 19.4.x

QID Detection Logic (Authenticated):
This QID check Windows registry to see if vulnerable version of Dell EMC NetWorker is installed.

Apache Log4j remote code execution vulnerability that may be exploited by malicious users to compromise the affected system Dell EMC NetWorker Server.

  • CVSS V3 rated as Critical - 10 severity.
  • CVSS V2 rated as Critical - 9.3 severity.
  • Solution
    Further information can be obtained from DSA-2021-280
    Workaround:
    Download the latest version of the logpresso tool from the following location: https://github.com/logpresso/CVE-2021-44228-Scanner.
    Choose the latest logscanner tool for "Any OS".
    Copy the logpresso-log4j2-scan-XXX.jar to C:\temp directory on the NetWorker server.
    Run logpresso jar against the affected locations.

    CVEs related to QID 376231

    Software Advisories
    Advisory ID Software Component Link