topic Block on APP-ID (Apache Log4j ) in Advanced Threat Prevention Discussions

Block on APP-ID (Apache Log4j )

Scott64 — Mon, 13 Dec 2021 12:37:36 GMT

Hello All,

After a bit of help ...I' have never created a block type rule on a Palo and now my boss wants me to create a .block rule for the above.

We have about 300 policies in the our firewall so no idea how to create a block and apply it .

Can anybody give me any pointers ?

Regards

Re: Block on APP-ID (Apache Log4j )

Sample_Wu — Wed, 15 Dec 2021 03:14:02 GMT

You need to do it by applying vulnerability security profile to each policy, or edit the security profiles you already applied to the security rules.

But, the default action of log4j vulnerability signatures are "reset-server" and severity are critical:

You just need to make sure the rule in each security profile is included severity critical and action is default or other suitable type, as below screenshot of the default profile:

just provide me thought for you as a reference.

Regards,

Sample

Re: Block on APP-ID (Apache Log4j )

Scott64 — Wed, 15 Dec 2021 11:32:41 GMT

Hi - Thanks for that - I have created what I hope is correct.

Regards

Re: Block on APP-ID (Apache Log4j )

Kuhic567 — Tue, 15 Feb 2022 09:46:24 GMT

@Scott64 wrote:
Hello All,
After a bit of help ...I' have never created a block type rule on a Palo and now my boss wants me to create a .block rule for the above.
We have about 300 policies in the our firewall so no idea how to create a block and apply it .
Can anybody give me any pointers ?

Regards

Upgrade to Log4j 2.3.2 (for Java 6), 2.12.4 (for Java 7), or 2.17.1 (for Java 8 and later).

In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.

Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.

Also note that Apache Log4j is the only Logging Services subproject affected by this vulnerability. Other projects like Log4net and Log4cxx are not impacted by this.