How to mitigate the Log4j vulnerability on Windows servers for Fastvue Reporter (the correct way!)

This short video shows how to mitigate the Log4j vulnerability on Windows servers running Fastvue Reporter.

Fastvue Reporter uses Elasticsearch as its database, which uses Log4j for its own diagnostic logging.

Elastic has since downgraded the issue saying"Elasticsearch is not susceptible to remote code execution with this vulnerability due to our use of the Java Security Manager" which is good news:

However, we still recommend adding the LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable to your servers. Especially if you have other services installed that could also be using log4j under the hood. There are many of them out there!

To do this:
1. Log in to the server running Fastvue Reporter
2. Right-click the Start button and select System.
3. In the Settings window that appears, under Related Settings, click System Info.
4. In the System window that appears, on the left side, click Advanced system settings.
5. In the System Properties dialog that appears, under the Advanced tab, click the Environment Variables... button.
In the Environment Variables dialog, under System variables, click New....
6. Set Variable name to LOG4J_FORMAT_MSG_NO_LOOKUPS
Set Variable value to true
7. Click OK on each dialog until you're back to the System window, which can now be closed.

Please follow these steps as soon as possible to avoid the Log4j vulnerability causing issues in your network.

To stay updated with Fastvue's product and security updates, subscribe to our mailing list making sure you check the 'Product Updates & News' checkbox.

[SonGoku-iosh]

Is it not meant to be log4j2 or does this cover all versions?

[srinivasp]

Is there any fix for epop-agent 6.5 using log4j 1.2? Uninstall will do any impact?

[Cerx]

This is only viable for log4j 2.10< versions. only use this when updating to 2.16 is not a possibility.
EDIT: Flags and Env variables are no longer considered full countermeasures. GLHF

[mozpony]

same comment @srinivas P, do you have a fix for vcenter on windows

[steinarmyrvang]

Is there any flipside to the workaround?

[padmasree]

Hi we are using spring boot java application, spring boot by default providing the log4j-api 2.12.2 jar and log4j-to slf4j jar files. We are not using only slf4j, and we didn't used these in pom.xml file, but safer we just added log 4j- 2.15 version jar. There will be any problem or Is there any alternate?

[fastvue]

Hey everyone. Just to be clear, this mitigation is for anyone our Fastvue Reporter product. Fastvue Reporter uses Elasticsearch v5.6.14 which runs one of the vulnerable versions of Log4j under the hood. Unfortunately, it is not possible to update our Elasticsearch version at this time, so customers must add this environment variable to their server running Fastvue Reporter to mitigate the vulnerability. You can stay up to date with Fastvue's advice here:

The reason this video is labelled 'the correct way' is because we posted an older video with incorrect steps. It showed adding the environment variable to the user variables section instead of the system variables section.

Apologies for any confusion!

[srinivasp]

Can you please help with how to fix in 2008 r2 server which is running with vcenter 5.5

[sameerudeen]

u can easily block this from firewall IPS