Return
-
Title
Safeguard for Privileged Session critical notification for KB 336007 -
Description
Safeguard for Privileged Sessions may be affected by the recent Apache Log4j 0-day vulnerability (CVE-2021-44228).
How does this affect me?
When Safeguard for Privileged Analytics is enabled, Safeguard for Privileged Sessions is potentially vulnerable to exploitation of the log4j vulnerability. Given the way log4j is used in the product, the likelihood of exploitability is low, but we are sending this notice and recommend taking protective action out of an abundance of caution.
-
Cause
This is an industry-wide vulnerability affecting the Apache Log4j itself and is not specific to Safeguard for Privileged Sessions
-
Resolution
WORKAROUND:
To disable the Analytics functionality please go to Basic Settings > Local Services > Privileged Account Analytics
Once there uncheck the "Enable" checkbox.
Further information can be found here.
RESOLUTION:
For information on how to install the below hotfixes, please consult the Safeguard for Privilege Sessions admin guide located here.
For LTS release:6.0.11 Hotfix download
For Feature releases:6.9.3 Hotfix download
6.10.0 Hotfix download
6.10.1 Hotfix download
6.11.0 Hotfix download
6.11.1 Hotfix download
NOTE: After the appropriate hotfix is installed, Safeguard Analytics maybe re-enabled.
To re-enable, please follow the reverse instructions located within the workaround section of this document.