Solution Apache Log4j Vulnerability in Omada Controller - Updated on May 18, 2022 [Case Closed]
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hi All,
TP-Link is aware of the vulnerability in Apache Log4j used in Omada Controller (CVE-2021-44228: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints).
Affected Products/Services:
Omada Cloud Services
Omada Controller (Windows)
Omada Controller (Linux)
Omada Controller OC200
Omada Controller OC300
Omada Discovery Utility
Kind note: Pharos Control is not affected.
Available Solutions:
So far, the TP-Link team has fixed the vulnerability on the cloud platforms, including Omada Cloud-Access.
For Local Omada Controllers, you may install the Beta firmware below for an emergency solution.
Omada SDN Controller:
Omada_Controller_V5.0.15_Windows (Beta)
Omada_Controller_V4.4.6_Linux_x64.tar (Beta)
Omada_Controller_V4.4.6_Linux_x64.deb (Beta)
OC200(UN)_V1_1.14.1_20211213 (Beta) -- Built-in Omada Controller v5.0.21
OC300(UN)_V1_1.2.4_20211213 (Beta) -- Built-in Omada Controller v4.4.6
Omada Controller V3.2.14:
Omada_Controller_V3.2.15_Windows_32bit (Beta)
Omada_Controller_V3.2.15_Windows_64bit (Beta)
Omada_Controller_V3.2.15_Linux_x64.tar (Beta)
Omada_Controller_V3.2.15_Linux_x64.deb (Beta)
OC200(UN)_V1_1.2.5_Build 20211214 (Beta)
Note: The Beta firmware provided above has updated log4j version to 2.15.0 to fix the original vulnerability (CVE-2021-44228).
Here are the official releases for Omada SDN Controllers to fix the vulnerability:
Omada_Controller_V4.4.8_Linux_x64.tar Release Note >
Omada_Controller_V4.4.8_Linux_x64.deb Release Note >
Omada_Controller_V5.0.30_Windows Release Note >
Omada_Controller_V5.0.30_Linux_x64.tar Release Note >
Omada_Controller_V5.0.30_Linux_x64.deb Release Note >
OC200(UN)_V1_1.14.3 Build 20220112 Release Note > Built-in Omada Controller v5.0.30
OC300(UN)_V1_1.7.1 Build 20220112 Release Note > Built-in Omada Controller v5.0.30
Kind Note:
1. The Official firmware provided above has updated log4j version to 2.16.0 to fix the followed vulnerability (CVE-2021-45046).
2. Omada Controllers or Services are NOT affected by the last vulnerability (CVE-2021-45105).
But TP-Link still released a new official firmware to upgrade log4j version to 2.17.0.
The following Omada SDN Controller v5 has upgraded log4j version to 2.17.0:
Omada_Controller_v5.1.7_Linux_x64.tar.gz Full Release Note >
Omada_Controller_v5.1.7_Linux_x64.deb Full Release Note >
Omada_Controller_v5.1.7_Windows Full Release Note >
OC200(UN)_V1_1.15.2_20220323 Full Release Note > Built-in Omada Controller v5.1.7
OC200(UN)_V2_2.1.2_20220323 Full Release Note > Built-in Omada Controller v5.1.7
OC300(UN)_V1_1.8.2 Build 20220411 Full Release Note > Built-in Omada Controller v5.1.8
The following Omada Controller v3 has upgraded log4j version to 2.17.0:
Omada_Controller_V3.2.16_Windows_32bit Release Note >
Omada_Controller_v3.2.16_Windows_64bit Release Note >
Omada_Controller_v3.2.16_Linux_x64.deb Release Note >
Omada_Controller_V3.2.16_Linux_x64.tar Release Note >
OC200(UN)_V1_1.2.6_Build 20211230 Release Note >
The following Omada Discovery Utility version has upgraded log4j version to 2.16.0:
Omada Discovery Utility 5.0.8 Release Note >
> upgraded log4j version to 2.16.0 to avoid remote code execution vulnerability in Apache log4j2.
This solution post has been updated completely by May 18, 2022.
Thank you for your attention!
References:
Solution Updated Records:
- Updated on 15th December 2021:
1. Add the Beta firmware for old Omada Controller v3.2.14.
2. Add the official firmware for Omada Controller v5.0.27 Windows.
Note: If you are using older Omada Controller, and wondering whether you can upgrade SDN Controller, you may refer to the guide below for a quick answer.
Frequently asked questions of Omada SDN solution related to upgrading and management
- Updated on 16 December 2021:
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. So the coming official firmware will update log4j version to 2.16.0 (CVE-2021-45046).
- Updated on 17 December 2021:
Add the official firmware for Omada Software Controller v4/v5, which updated log4j version to 2.16.0 (CVE-2021-45046)
- Updated on 21 December 2021:
Add the official firmware for Omada SDN Controller OC200/OC300, which updated log4j version to 2.16.0 (CVE-2021-45046)
- Updated on 22 December 2021:
Add a Kind Note:
3. Omada Controllers or Services are NOT affected by the last vulnerability (CVE-2021-45105).
But TP-Link will still release a new official firmware soon to upgrade log4j version to 2.17.0.
4. The official firmware for Omada Controller v3.2.14 will also upgrade log4j version to 2.17.0, which will be released afterwards.
- Updated on 9 January 2022:
Add official firmware for Omada Controller v5.0.29 (Linux) and Omada Discovery Utility v5.0.8, which updated log4j version to 2.16.0 (CVE-2021-45046).
- Updated on 26 January 2022:
Add official firmware for Omada Software Controller v3.2.16, which updated log4j version to 2.17.0.
- Updated on 10 February 2022:
Add official firmware for Omada Hardware Controller OC200 with built-in Controller v3.2.16, which updated log4j version to 2.17.0.
Replaced the Omada Controller v5.0.29 firmware with the Controller v5.0.30 (it's the later version which has fixed some issues came from v5.0.29).
- Updated on 7 May 2022:
Add official firmware for Omada Software Controller v5.1.7 and OC200 with built-in Controller v5.1.7, which updated log4j version to 2.17.0.
- Updated on 18 May 2022:
Add official firmware for OC300 with built-in Controller v5.1.8, which updated log4j version to 2.17.0.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
@WirelessForEver - Merry Christmas... Log4j is the gift that just keeps on giving!
- Copy Link
- Report Inappropriate Content
Looks like a new version is necessary:
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.
BTW: Any update on omada 5 for Linux?
- Copy Link
- Report Inappropriate Content
You should update to the first one OC200(UN)_V1_1.14.1_20211213 (Beta) -- Built-in Omada Controller v5.0.21, because you are using SDN v4 Controller.The other is for v3 Controller version.
- Copy Link
- Report Inappropriate Content
Dear @JustAnotherDave,
JustAnotherDave wrote
@Fae First I want to give you a huge THANK YOU for being so responsive and forthcoming with information. It's been such a relief. I do have another follow-up question for you: my OC300 controller version is 4.3.5, and the firmware is indicating 1.1.0 build 20210406 Rel.58776. Do you anticipate that I will be able to update directly to the latest patch when it is available?
You are most welcome. Regarding your question, yes, you can update your OC300 1.1.0 to the latest patch when it's available.
- Copy Link
- Report Inappropriate Content
@Fae I just wanted to add my additional thanks to you and team for your prompt attention to this matter.
From catching up on the most recent posts it appears that 2.17.0 is the most current version required to address all currently known Log4j CVEs or have I read this incorrectly?
I'm running the Beta OC200 SDN firmware with its revision to 2.15.0. Should we expect the release version to include 2.17.0 or anticipate another Beta cycle?
Kind regards,
S.
- Copy Link
- Report Inappropriate Content
Dear @st3v3np, @buntspext, @WirelessForEver,
st3v3np wrote
From catching up on the most recent posts it appears that 2.17.0 is the most current version required to address all currently known Log4j CVEs or have I read this incorrectly?
I'm running the Beta OC200 SDN firmware with its revision to 2.15.0. Should we expect the release version to include 2.17.0 or anticipate another Beta cycle?
Thank you so much for your valued feedback!
The Omada Controllers or Services are not affected by the last Log4j CVE-2021-45105. But TP-Link will still release a new official firmware soon to upgrade log4j version to 2.17.0.
BTW, the official firmware for Omada SDN Controller has been provided in this solution post yesterday, which has upgraded the log4j to 2.16.0, please take your time for an upgrade.
- Copy Link
- Report Inappropriate Content
Yesterday I updated two OC200 with the new firmware.
The first installed and rebooted as planned.
The second OC200 get stuck in a bootloop, i coludn't even ping it. After restart, the bootloop stays.
Both controllers have similar configuration. Only difference is the power source: the first OC200 was only powered from PoE, the second from PoE and USB (5V/3A). Could this cause problems?
My solution was to start the controller in recovery mode (press "reset" while powering on), open 0.253 and install the new firmware again. I don't use the USB Adapter anymore.
After the installation it boots and all the config was still there.
- Copy Link
- Report Inappropriate Content
could you explain why oc200oc300 firmware was upgraded to a "beta" version 5.0.29 to fix the vulnerability?
If the Linux version was fixed with 4.4.8 version why not to let to upgrade to that for the hardware controllers. I've seen too many post that things are not getting great after the upgrade and v5 still seems raw. Will there be a 4.4.8 with a firmware update for the controllers?
- Copy Link
- Report Inappropriate Content
My OC200 Omada Controller upgrade failed twice
The 1st upgrade from 4.4.4 to 4.4.6 and the 2nd upgrade from 4.4.4 to 5.0.30
In both upgrade I got the Downloading window and after that the Rebooting window, when the rebooting finished the Omada Controller was OFFLINE.
I was able to recover the Omada Controller in both cases with the following procedure going back to firmware version 4.4.4
https://www.tp-link.com/us/support/faq/3114/
- Copy Link
- Report Inappropriate Content
Dear @Moyshka,
Moyshka wrote
My OC200 Omada Controller upgrade failed twice
The 1st upgrade from 4.4.4 to 4.4.6 and the 2nd upgrade from 4.4.4 to 5.0.30
In both upgrade I got the Downloading window and after that the Rebooting window, when the rebooting finished the Omada Controller was OFFLINE.
I was able to recover the Omada Controller in both cases with the following procedure going back to firmware version 4.4.4
https://www.tp-link.com/us/support/faq/3114/
Sorry to hear that you have trouble with the upgrade. I've followed up with your case in this post.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 11
Views: 39814
Replies: 66
Voters 9
