Got a virus and need advice please
-
Hi guys,
I just scanned a VM and found a positive... :(
"/lib/ace.jar: Java.Malware.CVE_2021_44228-9915814-6 FOUND"Question is what I need to do... The machine is on my mangement lan, as are all switches, and the affected file is part of unifi, who isn't really seem to understand that I am asking for help...
What should I do? Reinstall everything?
-
@furom said in Got a virus and need advice please:
CVE_2021_44228-9915814-6
that is log4j - what version of the controller software are you running? they have all kinds of info on how to update their software.
You didn't get a virus btw, their was just some problems in that code that have been found to be exploitable...
You need to update their software to replace the code to use new version..
This would have nothing to do with pfsense at all - moving this to general area.
-
J johnpoz moved this topic from Firewalling on
-
@johnpoz said in Got a virus and need advice please:
@furom said in Got a virus and need advice please:
CVE_2021_44228-9915814-6
that is log4j - what version of the controller software are you running? they have all kinds of info on how to update their software.
yes, realize it has nothing to do with pfSense, but have no where else to turn really, unifi support is a joke.
I am running latest, 7.0.23, upgraded yesterday, but have apparently had the linux unpatched for some time... :( Always on my toes with unifi network app though, but missed what was important.... -
@furom said in Got a virus and need advice please:
but have apparently had the linux unpatched for some time
Well yeah you need to update the OS the controller software runs on - this was jumped on pretty quickly, and pretty much every OS maker provided new versions very quickly. As well as apache..
https://logging.apache.org/log4j/2.x/security.html
I run their controller software as well in a vm, whenever I see they have a new version out I also update the OS (ubuntu in my case) before doing the unifi update..
I always take a snapshot before doing any updates for unifi, just in case have to roll back.. I am running 7.0.23 as well.
-
@johnpoz said in Got a virus and need advice please:
You didn't get a virus btw, their was just some problems in that code that have been found to be exploitable...
Strange thing is I am on the latest, 7.0.23, and it still reports this vuln...
-
@johnpoz said in Got a virus and need advice please:
Well yeah you need to update the OS the controller software runs on - this was jumped on pretty quickly, and pretty much every OS maker provided new versions very quickly. As well as apache..
Oh. Done that. So probably good then... oh my. Thanx for responding quickly, you saved me a lot of stress
-
@furom /lib/ace.jar wouldn't be unifi it would be something else.. unifi ace.jar file would be here
/usr/lib/unifi/lib/ace.jar
-
@johnpoz said in Got a virus and need advice please:
@furom /lib/ace.jar wouldn't be unifi it would be something else.. unifi ace.jar file would be here
/usr/lib/unifi/lib/ace.jarYeah, that would be a copy/paste error on my part. It was the unifi file that triggered the alert
-
-
This post is deleted!