Vulnerability on log4j: C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\Windows show log4j file in the system.

Question

Hi

i m using MS sql 2017 in my organization recently we scan the system with the Tenable scanner and we found some of the vulnerable file in sql on log4j.
those are "Apache Log4j 1.x Multiple Vulnerabilities" and "Apache Log4j SEoL (<= 1.x)"

that's because this .jar appear in one folder

Source: Manifest Vendor: Unknown, Manifest Version: Unknown, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\cloudera5_polybase.jar

log4j 1.2.17

Source: Manifest Vendor: Unknown, Manifest Version: Unknown, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\cloudera_polybase.jar

log4j 1.2.17

Source: Manifest Vendor: Unknown, Manifest Version: Unknown, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\hortonworks2_2_polybase.jar

log4j 1.2.17

Source: Manifest Vendor: Unknown, Manifest Version: Unknown, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\hortonworks2_polybase.jar

log4j 1.2.17

Source: Manifest Vendor: Apache Software Foundation, Manifest Version: 1.2.17, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\polybase.jar!log4j-1.2.17.jar

log4j 1.2.17

Source: Manifest Vendor: Unknown, Manifest Version: Unknown, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\polybase.jar

log4j 1.2.17

Source: Manifest Vendor: Apache Software Foundation, Manifest Version: 1.2.17, JNDI Class: NOT Found, Log4j Vendor: log4j, Log4j Version: 1.2.17
Path=C:\Program Files\Microsoft SQL Server\MSSQL14.SQLSERVER2017\MSSQL\Binn\Polybase\Hadoop\Windows\log4j-1.2.17.jar
log4j 1.2.17

How can we address this vulnerability?

Thank you!

Jonathan

Answer 1

Hi @Moya Cardenas, Jonathan

According to my searches, on August 5, 2015, the Log Service Project Management Board announced that Log4j 1.x was end of life. Since Log4j 1 is no longer maintained, none of the issues listed will be resolved. Users are urged to upgrade to Log4j 2.

You can get more information on this site:

https://logging.apache.org/log4j/1.x/

https://logging.apache.org/log4j/2.x/

Microsoft has released a response to CVE-2021-44228 Apache Log4j 2, maybe you can use it as a reference.

https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

https://msrc.microsoft.com/blog/2021/12/microsofts-response-to-cve-2021-44228-apache-log4j2/

If the answer is helpful, please click Accept Answer and Up-Vote for the same. If you have any questions, please feel free to let me know.

Best regards,

Aniya