IJ15202: JAVA JMX SERVER INSECURE CONFIGURATION REMOTE CODE EXECUTION VULNERABILITY FOR ZOOKEEPER

APAR status

• Closed as fixed if next.

Error description

• Environment:  APM server
  APM release number where the problem was found:  8.1.4.0
  
  Problem Description:
  
  The Java JMX Server Insecure Configuration Remote Code Execution
  Vulnerability for the Zookeeper service may be reported in
  security scans since remote users can connect to the Zookeeper
  JMX port.   However,  the vulnerability cannot be exploited by
  remote users since Cloud APM configures Zookeeper to prevent
  remote users from retrieving data using JMX.
  
  The fix for the APAR will prevent remote users from connecting
  to Zookeeper's JMX port altogether.
  

Local fix

• 1. Edit
  <apm_server_install_directory>/kafka/bin/kafka-run-class.sh as
  root:
  
  in the section where the JMX options are set:
  
  # JMX settings
   if [ -z "$KAFKA_JMX_OPTS" ]; then
     KAFKA_JMX_OPTS="-Dcom.sun.management.jmxremote
  -Dcom.sun.management.jmxremote.authenticate=false
  -Dcom.sun.management.jmxremote.ssl=false "
   fi
  
  add "-Dcom.sun.management.jmxremote.host=localhost"  to the list
  of parameters as shown below:
  
  # JMX settings
  if [ -z "$KAFKA_JMX_OPTS" ]; then
     KAFKA_JMX_OPTS="-Dcom.sun.management.jmxremote.host=localhost
  -Dcom.sun.management.jmxremote
  -Dcom.sun.management.jmxremote.authenticate=false
  -Dcom.sun.management.jmxremote.ssl=false "
   fi
  
  2)  Restart Kafka by running this command:
  
  apm restart kafka
  

Problem summary

•  FIN
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels