Jamf Pro 10.34.1 Release Now Available

JenK
New Contributor II
New Contributor II
Hello Jamf Nation,
 
Today we're releasing an update for Jamf Pro that addresses critical security issue CVE-2021-44228. For details on how we’re addressing this vulnerability across the Jamf platform, please see this Jamf Nation post.
 
We strongly recommend that you upgrade to Jamf Pro 10.34.1 as soon as possible. 
 
Please read the resolved issues section of the release notes for more information. Additional details on the resolved vulnerability will be made available on a future date to allow for Jamf Pro instances to be updated before full disclosure.
 
Please note that this only impacts Jamf Pro environments hosted on-premises. Customers utilizing our cloud-based products have had the vulnerability mitigated through appropriate security controls.
 
We will also be sending this information via email to primary technical contacts at affected organizations.
 
Update:
The bug fix description for PI-010403 in the release notes has been updated to reflect recently discovered information.
16 REPLIES 16

bethjohnson
New Contributor III

What's the status of the Jamf Pro Server Tools in this release? Do we need to reinstall a non-broken version?

david_brazeau
New Contributor II

@bethjohnson No, 10.34.1 contains Jamf Pro Server Tools 2.7.11, so you do not need to reinstall anything.

user-KMLLovVGkW
New Contributor

Just an idea.. Maybe throw the link to download the release here as well.

https://account.jamf.com/products/jamf-pro

PS, read the update FYI regarding Server Tools version 2.7.11.

--
https://donmontalvo.com

donmontalvo
Esteemed Contributor II

Thanks for the fast zero-day mitigation. Plus, its raining here, so. 🙂

--
https://donmontalvo.com

donmontalvo
Esteemed Contributor II

Jamf...please preserve our session timeout in session.properties file...it gets reverted to default on every update. 🙂

--
https://donmontalvo.com

iviemeister
New Contributor II

Note that contrary to the comment in the release notes: "This vulnerability poses a risk to private data. It does not have the potential to impact managed devices or the integrity and availability of your web server." - this does appear to allow RCE as the "jamftomcat" user.

Between looking for this update/remediation and deploying it, we discovered a Monero-miner bot dropped in /tmp, running as the jamftomcat user.

Given that the jamftomcat user has access to the DB, and is the owner of most of the executable files in a JSS deployment, I'd say that this absolutely DOES have "the potential to impact managed devices or the integrity and availability of your web server".

 

Thanks you @iviemeister, we will update our release notes. 

If you experience any issues with your Jamf Pro server please report it to technical support as soon as possible. Cloud instances sit behind a web application firewall that actively is filtering out malicious traffic. Anomaly detection tools are implemented and tested to verify that it catches and alerts on any concern that are raised. As always if you see an issue with an on premise Jamf Pro installation or Jamf Cloud please immediately reach out to support@jamf.com

Aaron Kiemele
Chief Information Security Officer, Jamf

Hi @Aaron_Kiemele - the full details of what we found are in Case #: JAMF-3302240, opened last night.

Hey is WAF implementation safe or are there ways to bypass, or Should we also update our Cloud Instance to 10.34.1 if possible?

https://twitter.com/bountyoverflow/status/1470001858873802754?s=21 

Best Regards
colorenz

While I cannot speak to individual cases, WAF is not sufficient alone, it should be used in conjunction with other layered security controls, proper configuration of the log4j2.formatMsgNoLookups parameter and/or a fully patched version such as 10.34.1. I would encourage you to reach out to support to discuss your individual case or refer to details described in primary thread for the issue

Thanks for you response.

We are in the Jamf Premium Cloud.

The question was: Is jamf detecting every attack ? Or is it possible to bypass your security Systems?

 

And should we schedule a update with the support to update to 10.34.1 as soon as possible?

donmontalvo
Esteemed Contributor II

log4shell

^^^Just adding so it comes up in a search.

--
https://donmontalvo.com

hansjoerg_watzl
Contributor II

I updated our Jamf Pro on premise server yesterday to 10.34.1. Was surprised, that still log4j version 2.15 will be installed, which is not 100% safe. Version 2.16 should be installed. (I manually installed it from the apache page after the Jamf update.)

Hopefully Jamf will include log4j 2.16 in their 10.34.1 package as soon as possible!

Jamf confirmed the product isn’t affected by CVE-2021-45046, so 2.16 isn’t needed. 

--
https://donmontalvo.com

jracosta
New Contributor III

Thanks for the quick release but seeing some GUI navigation issues with the on-prem version of 10.34.1. Specifically some back buttons in the GUI are not working and/or returning to other screens. Most notably viewing devices attached to a smart/group or an inventory report, the back button is not working in the GUI.