Log4j vulnerabilities

[karljwogoman]

I'd like some direction on how to remediate the below vulnerabilities on our fnms inventory/batch server.

No java is installed to update.

Cognos has been removed from the system. Could these be remnants left over from a Cognos removal?

Microsoft ODBC Driver 13 for SQL Server is installed on this server. Is this needed for connection to an Oracle database in FlexNet Manager Platform Business Adapter Studio or FNMS?

Path : C:\Program Files(x86)\client32\stage\Components\oracle.dbdev\12.1.0.1.0\1\DataFiles\filegroup1.jar                        file last modified 6/30/2013
Installed version : 1.2.13
Fixed version : 2.16.0

Path : C:\V38892-01\client32\stage\Components\oracle.dbdev\12.1.0.1.0\1\DataFiles\filegroup1.jar file last modified 6/30/2013
Installed version : 1.2.13
Fixed version : 2.16.0

Path : F:\Oracle12\client32\stage\Components\oracle.dbdev\12.1.0.1.0\1\DataFiles\filegroup1.jar file last modified 6/30/2013
Installed version : 1.2.13
Fixed version : 2.16.0

Path : C:\Oracle\product\12.1.0\client_1\sqldeveloper\sqldeveloper\lib\log4j-1.2.13.jar                        last modified 2/20/2013
Installed version : 1.2.13
Fixed version : 2.16.0

[ChrisG · Accepted solution]

These directory paths suggest that the files you're looking at here are related to some Oracle component(s).

Microsoft ODBC Driver 13 for SQL Server is not required for connecting to Oracle Database for business imports or inventory. A prerequisite on the beacon for doing that is Oracle OLE DB Provider (32-bit), version 10.2.0.3 or later.