News from 2021-12-13


Meinberg LANTIME and microSync Systems not at Risk from Log4j Security Exploit


In light of the higher than usual number of inquiries from our customers, we would like to inform all those concerned that no LANTIME or microSync product is affected by the zero-day vulnerability recently identified in the Log4j Java library. There is therefore no need for any security-related measures for these Meinberg products.

Meinberg SyncFire NTP servers are based on server products from Fujitsu (SF1000 and SF1100 models) and HPE (SF1200); these feature an integrated management controller (iRMC in the case of Fujitsu, and iLO in the case of HPE). These two manufacturers have not yet notified us as to whether their respective management controllers might utilize one of the affected versions of Log4j . As yet, we have no indication that these subsystems are at any risk.

SyncFire systems are shipped with these management controllers disabled for customer use by default, and can only be enabled on request. This means that, as long as the Ethernet interface of the management controller (iRMC/iLO) of a SyncFire system remains physically disconnected, there is no chance that a SyncFire system could be compromised using this Log4j exploit.

We are in contact with the manufacturers of our SyncFire base server models and will update this advisory accordingly as soon as we have further information.

Please refer to the following links for more information about this vulnerability (which affects Log4j versions <= 2.14.1):

MITRE CVE: CVE-2021-44228
The Mitre Corporation

Apache Log4j Security Vulnerabilities
Logging Services apache.org

Update 14.12.2021 - 8:49 CET:

HPE has confirmed in its Security Advisory https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00120086en_us that the "Integrated Lights-Out 5 (iLO 5)" management controller in the Meinberg SyncFire SF1200 is not affected.

Update 15.12.2021 - 8:38 CET:

Fujitsu has confirmed in its Security Advisory Fujitsu-PSIRT-PSS-IS-2021-121000-Security-Notice-SF.pdf that the "iRMC on PRIMERGY" management controller used in the Meinberg SyncFire SF1000 and SF1100 models is not affected.

You can find all Information about Security Vulnerabilities on our Website.


Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact Meinberg Mail Contact