ArcGIS Log4j security alert

• We strongly advise using the supplied scripts now rather than waiting for additional patches to become available.

As a starting point to troubleshoot the error, please check that:

• The user is logged in on the machine as the administrator or the ArcGIS Datastore/Portal/Server “run as” account.

• The ArcGIS Data Store/Portal/Server service has been stopped so the files can be modified.

• Verify that there aren’t any processes running under the ArcGIS Datastore/Portal/Server account in Task manager on the machine that may be locking the files. If processes are running, select “End task” in the Task manager.

• Verify that the account used to execute the scripts has read/write permissions to the server/portal/datastore directories mentioned in the technical articles.

• Download and install Python 3 on the server machine where ArcGIS Data Store is installed: https://www.python.org/downloads

• Follow the installation steps at https://docs.python.org/3/using/windows.html

• Note: You may also need to install Python 3 if you are running an older version (10.5 and below) of the stand-alone ArcGIS Server. Additionally, please ensure that the path to Python in the command window will match the location on the server where the Python 3 is installed. For example, if during the installation you specified the installation directory as “C:\ProgramFiles\Python3”, the script command line would reference this location to execute python.exe

Running the script on the systems where only Python 2.7 is installed will produce following message: "This script must be run with Python v3."

• No, the service that needs to be stopped is the ArcGIS Server service account that runs the software and can be found under Windows Services:

• Customers who are using ArcGIS Enterprise versions in Mature/Retired phase (version 10.5.x and below) are strongly recommended to upgrade to the latest supported version of ArcGIS Enterprise. Software in mature or retired status does not receive patches for any security vulnerabilities.

Yes. Esri is recommending that the mitigation scripts are applied to all installations of any version of ArcGIS Enterprise and ArcGIS Server to remove the JndiLookup class.  Scripts have been validated for versions 10.6 and above, however they should work for older versions of ArcGIS Enterprise and ArcGIS Server as well.

• Any version 3.5 or higher should be sufficient to run the script.

• Esri does not recommend updating the Java classes manually. Customers are strongly encouraged to use the supplied mitigation scripts.

• The scripts remove the JndiLookup class which is the only mitigation measure recommended by Apache Log4j that does not require updating the Log4j version. After applying the mitigation scripts, you will still see vulnerable Log4j version numbers on these systems, however the vulnerable code has been removed.

• The scripts remove the JndiLookup class which is the only mitigation measure recommended by Apache Log4j that does not require updating the Log4j version. After applying the mitigation scripts, you will still see vulnerable Log4j version numbers on these systems, however the vulnerable code has been removed.

Several security scanners by default perform rudimentary validation of Log4j security issues resulting in false positive critical alerts even after running Esri’s mitigation scripts. 

To avoid false positives, make sure the scanner is appropriately configured and your team is looking at the right location/plugin results. Alternatively, you can use a simpler, purpose-built security tool to validate and ensure the issue has been addressed.

1. A Tenable security scanner provides numerous plugins to help detect Log4j issues, however default Plugin 156002 only checks the versions of Log4j and therefore creates a false positive critical alert even after running Esri’s mitigation scripts. Direct your team to the Ports sections of Plugin 156001 instead, as it correctly indicates if the Critically vulnerable code has been removed from Log4j and will show: JndiLookup.class association : Not Found

2. A LogPresso Log4j Scanner is a free tool listed by the Center of Internet Security for identifying Log4j issues, that correctly identifies if your ArcGIS Enterprise Log4j components have been mitigated for the critical vulnerabilities by default.

The tool requires no install, runs natively on Windows or Linux, typically takes less than two minutes to scan Esri products, and can be executed at a command prompt by simply pointing it to the installation directory (target_path) of any Esri product as follows: log4j2-scantarget_path