Welcome to log4jscanwin Discussions!

[romw]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[Freedomfiend]

What exactly does the remediation tool do? I ran it and ran a scan again. Still shows the vulns.

[romw]

The scanner utility is capable of detecting several different CVE(s): CVE-2021-4104, CVE-2021-44228, CVE-2021-44832, CVE-2021-45046, CVE-2021-45105

The remediation utility is only able to remediate the following CVE(s): CVE-2021-44228, CVE-2021-45046

Per the recommendation of the Apache Logging Team one remediation tactic was to execute:
zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

However, not all versions of Windows have a command line version of zip/unzip available as a command line tool. So, we created a special purpose command line remediate utility to provide that functionality.

When using the scanner utility, you can specifically use the /scan_file argument and point to the JAR file to just remediated to see if it is tripping up against a different CVE.

[Ben-Yates]

Hello,

Hope everyone is safe and well. Forgive me is this is a silly question, we've run the scanner with the advised settings: /scan /report_sig
However when we browse to the Qualys folder ( C:\Program Data\Qualys ) we can't see the file when the scan completes, so when we run the remediate tool with the remediate_sig, nothing appears to happen.

I'm certain we're doing something wrong our end, so would be grateful if someone could point us in the right direction.

Best wishes