New Log4j2 vulnerability
nvd.nist.gov
New Log4j2 vulnerability
1–10 of 49 posts
Re: New Log4j2 vulnerability
#2"Log4j2 versions 2.0-beta7 through 2.17.0 are vulnerable to a remote code execution attack if an attacker with permission to modify the logging configuration file can construct a malicious configuration"
Re: New Log4j2 vulnerability
#3The threat here is that "an attacker with permission to modify the logging configuration file can construct a malicious configuration". If the attacker can modify server config files, this particular log4j fixup is likely to still leave you with nasty problems.
Re: New Log4j2 vulnerability
#4Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.
Re: New Log4j2 vulnerability
#5Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.
Yeah, maybe should be mentioned in the title to save people from PTSD over the holidays...
Re: New Log4j2 vulnerability
#6If you've been impacted by these log4j vulnerabilities, have a look at aegis4j, a Java agent that completely disables platform features you don't use, before an attacker uses them against you (including e.g. JNDI and Java serialization).
Re: New Log4j2 vulnerability
#7Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.
Yeah, maybe should be mentioned in the title to save people from PTSD over the holidays...
If I could have have changed the title I would have added something to make it give less PTSD
Re: New Log4j2 vulnerability
#8I've just started looking, and I'm not an expert.
The key point here is log4j can get configuration a lot of different ways, including a network request. Based on https://logging.apache.org/log4j/2.x/manual/configuration.ht... control over dns would let you rewrite sections of config, and thus run arbitrary code.
So, if you've got some access, this would allow you to escalate that access to a full RCE. I think that's why it's only Medium severity.
Re: New Log4j2 vulnerability
#9The threat here is that "an attacker with permission to modify the logging configuration file can construct a malicious configuration". If the attacker can modify server config files, this particular log4j fixup is likely to still leave you with nasty problems.
yes that would be true. Unfortunately log4j doesn't get configuration exclusively from config files on the server where it's running. this doesn't look like no access to full RCE like the first few rounds. But this might let an attacker turn a small exploit into a big exploit.
Re: New Log4j2 vulnerability
#10The worst part of these major vulnerabilities is the endless follow-on stream of knee-jerk 'CVE' that are clearly nothing-burgers, and yet will be described as a 'new Log4j' vulnerability, and cause a bunch of people who don't know better to panic.