Techsupport request: PAC/P1-AM (Arduino) log4j vulnerability advice

kewakl (Customer) asked a question.

Edited December 13, 2021 at 1:23 PM

I do not mean to sound alarmist, just looking for knowledgeable input and advice.

Anyone who had access to tech news last week and over the weekend should have seen the headlines re: log4j/log4shell

~~I have looked in the downloaded files and in the installation folders for PAC Suite and find no references to log4j.~~

Digging deeper, I do find log4j entries in:

C:\Program Files (x86)\AutomationDirect\Productivity Suite 1.7.1.1\lib\commons-logging.jar\org\apache\commons\logging\impl\

C:\Program Files (x86)\AutomationDirect\Productivity Suite 3.10.2.1\lib\commons-logging.jar\org\apache\commons\logging\impl\

(Log4jCategoryLog.class, Log4jFactory.class, Log4JLogger.class)

I do find multiple occurrences of log4j (2.12.0) in my arduino install folder.

(zdnet 2021/12/10 Systems and services that use the Java logging library, Apache Log4j between versions 2.0 and 2.14.1 are all affected, including many services and applications written in Java.)

Please advise. Can log4j/log4shell impact our project development, maintenance ....

ADC_AutomationControls_PM01 (AutomationDirect)
5 years ago
Regarding Productivity CPUs and Productivity Suite, the Log4j library is not used in any part of Productivity. Class names that are found in the commons-logging.jar file are references but are unused and their targets are unpopulated. We are exploring an updated release of Productivity Suite that has these references removed, but at this time there appears to be no risk from this library in Productivity Suite or Productivity CPUs.
Expand Post
Selected as Best

FACTS_AdamC (AutomationDirect)
Edited December 16, 2021 at 12:24 PM
Thanks for the heads up. I'm certainly no expert in this area either, but it appears at least Arduino is aware and is already working on upgrading the Arduino software to correct the vulnerability(https://github.com/arduino/Arduino/commits/master). ~~I don't see a formal release from them, but I would anticipate one soon.~~
Expand Post
- FACTS_AdamC (AutomationDirect)
  Edited December 16, 2021 at 12:27 PM
  Arduino update available here: https://www.arduino.cc/en/software
  Summary from Arduino: https://support.arduino.cc/hc/en-us/articles/4412377144338-Arduino-s-response-to-Log4j2-vulnerability-CVE-2021-44228
  TLDR: Arduino is unlikely to be an exploit target, but to be safe only install cores provided by Arduino as part of the official index file, or by trustworthy third party sources.
  Expand Post
FACTS_TimR (AutomationDirect)
5 years ago
Thank you for bringing this to our attention. Let me look into this and get back with you soon. Thank you.
Expand Post
kewakl (Customer)
Edited December 13, 2021 at 1:50 PM
I have seen a suggested workaround

>"The flag “log4j2.formatMsgNoLookups” does not disable the functionality for log4j version < 2.10."
https://www.truesec.com/hub/blog/apache-log4j-injection-vulnerability-cve-2021-44228-impact-and-response

edit: added italics for quoted line from linked page
Expand Post
ADC_AutomationControls_PM01 (AutomationDirect)
5 years ago
Regarding Productivity CPUs and Productivity Suite, the Log4j library is not used in any part of Productivity. Class names that are found in the commons-logging.jar file are references but are unused and their targets are unpopulated. We are exploring an updated release of Productivity Suite that has these references removed, but at this time there appears to be no risk from this library in Productivity Suite or Productivity CPUs.
Expand Post
Selected as Best
- kewakl (Customer)
  5 years ago
  Thank you for the response. I would think that this took some digging to determine.
  Thanks again.
  Expand Post

Related Questions

Sign Up

Connect With Us

Company Information

Contact Us