【威胁通告】VMware 多个产品存在 Log4j2远程代码执行漏洞（CVE-2021-44228）通告

2021-12-14

一. 漏洞概述

近日，海王捕鱼CERT监测到VMware 发布安全通告，VMware的众多产品受Apache Log4j2远程代码执行漏洞（CVE-2021-44228）的影响。由于Apache Log4j2某些功能存在递归解析功能，未经身份验证的攻击者通过发送特别构造的数据请求包，可在受影响的 VMware 产品中执行任意代码。漏洞PoC已公开，且发现在野利用，建议相关用户尽快采取措施进行排查与防护。

参考链接：

https://www.vmware.com/security/advisories/VMSA-2021-0028.html

二. 影响范围

受影响产品（更新中）：

VMware Horizon

VMware vCenter Server

VMware HCX

VMware NSX-T Data Center

VMware Unified Access Gateway

VMware WorkspaceOne Access

VMware Identity Manager

VMware vRealize Operations

VMware vRealize Operations Cloud Proxy

VMware vRealize Log Insight

VMware vRealize Automation

VMware vRealize Lifecycle Manager

VMware Telco Cloud Automation

VMware Site Recovery Manager, vSphere Replication

VMware Carbon Black Cloud Workload Appliance

VMware Carbon Black EDR Server

VMware Tanzu GemFire

VMware Tanzu Greenplum

VMware Tanzu Operations Manager

VMware Tanzu Application Service for VMs

VMware Tanzu Kubernetes Grid Integrated Edition

VMware Tanzu Observability by Wavefront Nozzle

Healthwatch for Tanzu Application Service

Spring Cloud Services for VMware Tanzu

Spring Cloud Gateway for VMware Tanzu

Spring Cloud Gateway for Kubernetes

API Portal for VMware Tanzu

Single Sign-On for VMware Tanzu Application Service

App Metrics

VMware vCenter Cloud Gateway

VMware Tanzu SQL with MySQL for VMs

VMware vRealize Orchestrator

VMware Cloud Foundation

VMware Workspace ONE Access Connector

VMware Horizon DaaS

VMware Horizon Cloud Connector

VMware NSX Data Center for vSphere

VMware AppDefense Appliance

不受影响产品（更新中）：

VMware vSphere ESXi

VMware vCloud Director

VMware vCloud Availability

VMware NSX Advanced Load Balancer (Avi)

VMware Software-Defined WAN (SD-WAN)

VMware Workspace ONE Assist

VMware RemoteHelp

VMware vCloud Usage Meter

VMware Tanzu Scheduler

VMware Tanzu Kubernetes Grid

SaltStack

参考链接：https://kb.vmware.com/s/article/87068

三. 漏洞防护

3.1 官方升级

目前官方已针对以下产品发布了新版本修复该漏洞，请受影响的用户尽快升级版本进行防护，对应产品版本的下载链接及文档如下：

产品版本	下载链接	操作文档
VMware Tanzu Operations Manager href="https://network.pivotal.io/products/ops-manager/" 2.10.23	https://network.pivotal.io/products/ops-manager/	https://docs.pivotal.io/ops-manager/2-10/release-notes.html#2-10-23
VMware Tanzu Application Service 2.12.3、2.11.10、2.10.22、2.7.42	https://network.pivotal.io/products/elastic-runtime	https://docs.pivotal.io/application-service/2-12/release-notes/runtime-rn.html#2.12.3 https://docs.pivotal.io/application-service/2-11/release-notes/runtime-rn.html#2.11.10 https://docs.pivotal.io/application-service/2-10/release-notes/runtime-rn.html#2.10.22 https://docs.pivotal.io/application-service/2-7/release-notes/runtime-rn.html#2.7.42)
VMware Tanzu Observability by Wavefront Nozzle href="https://network.pivotal.io/products/wavefront-nozzle" 3.0.3	https://network.pivotal.io/products/wavefront-nozzle
Healthwatch for Tanzu Application Service href="https://network.pivotal.io/products/p-healthwatch" 2.1.7, 1.8.6	https://network.pivotal.io/products/p-healthwatch
App Metrics href="https://network.pivotal.io/products/apm" 2.1.1	https://network.pivotal.io/products/apm
VMware Horizon Cloud Connector href="#product_downloads" 2.1.1	https://customerconnect.vmware.com/downloads/details?downloadGroup=HCS-CC-210&productId=716&rPId=79131#product_downloads
VMware Carbon Black EDR Server 7.6.0	https://community.carbonblack.com/t5/Endpoint-Detection-and-Response/VMware-Carbon-Black-EDR-Announcing-General-Availability-of-EDR/td-p/109189

三.2 临时防护措施：

1.若业务环境允许，可使用白名单限制web端口访问方式来降低风险

2.客户可根据自身产品结合下列参考链接采取临时防护。

产品版本	参考链接
VMware Horizon 8.x, 7.x	https://kb.vmware.com/s/article/87073
VMware vCenter Server 7.x, 6.x	https://kb.vmware.com/s/article/87081?lang=en_US
VMware HCX 4.x, 3.x	https://kb.vmware.com/s/article/86169
VMware NSX-T Data Center 3.x, 2.x	https://kb.vmware.com/s/article/87086
VMware Unified Access Gateway 21.x, 20.x, 3.x	https://kb.vmware.com/s/article/87092
VMware Workspace ONE Access 21.x, 20.10.x	https://kb.vmware.com/s/article/87090
VMware Identity Manager 3.3.x	https://kb.vmware.com/s/article/87093
VMware vRealize Operations 8.x	https://kb.vmware.com/s/article/87076
VMware vRealize Operations Cloud Proxy Any	https://kb.vmware.com/s/article/87080
VMware vRealize Log Insight 8.x	https://kb.vmware.com/s/article/87089?lang=en_US
VMware Carbon Black Cloud Workload Appliance 1.x	https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-VMware-Carbon-Black-Cloud/ta-p/109167
VMware Carbon Black EDR Server 7.x, 6.x	https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-VMware-Carbon-Black-EDR/ta-p/109168
VMware Tanzu GemFire 9.x, 8.x	https://community.pivotal.io/s/article/Workaround-to-address-CVE-2021-44228-Apache-Log4j-Remote-Code-Execution-for-all-GemFire-versions?language=en_US
VMware Tanzu Greenplum 6.x	https://community.pivotal.io/s/article/Workaround-to-address-CVE-2021-44228-Apache-Log4j-Remote-Code-Execution-for-All-Greenplum-Versions?language=en_US
VMware Tanzu Operations Manager 2.x	https://community.pivotal.io/s/article/5004y00001mPn2N1639255611105?language=en_US
VMware Tanzu Application Service for VMs 2.x	https://community.pivotal.io/s/article/Workaround-instructions-to-address-CVE-2021-44228-in-Tanzu-Application-Service-2-7-through-2-12?language=en_US
VMware Tanzu Kubernetes Grid Integrated Edition 1.x	https://community.pivotal.io/s/article/Workaround-instructions-to-address-CVE-2021-44228-in-Tanzu-Kubernetes-Grid-Integrated?language=en_US
VMware Cloud Foundation4.x, 3.x	https://kb.vmware.com/s/article/87095
VMware Workspace ONE Access Connector (VMware Identity Manager Connector) 21.x, 20.10.x, 19.03.0.1	https://kb.vmware.com/s/article/87091
VMware Horizon DaaS 9.1.x, 9.0.x	https://kb.vmware.com/s/article/87101
VMware NSX Data Center for vSphere	https://kb.vmware.com/s/article/87099
VMware AppDefense Appliance	https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-AppDefense/ta-p/109180