Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Log4j2 vulnerability

nvd.nist.gov

Post reply on HN
Print view View original

21–30 of 49 posts

Re: New Log4j2 vulnerability

#21

Post by jfoutz »

alfiedotwtf wrote: post #13
jfoutz wrote: post #8

I've just started looking, and I'm not an expert. The key point here is log4j can get configuration a lot of different ways, including a network request. Based on https://logging.apache.org/log4j/2.x/manual/configuration.ht... control over dns would let you rewrite sections of config, and thus run arbitrary code. So, if you've got some access, this would allow you to escalate that access to a full RCE. I think that's…

Holy moly, how was that ever a good idea. Just like routers being able to be configured via the manufacturer's website, config by someone other than you seems like a big red flag

well log4j will be old enough to drink in a few weeks (January 8, 2001). It's way older than bcfg2 or ansible, chef, puppet, etc. I'm not sure when the functionality was added. I'd bet it was the bees knees at the time.

Re: New Log4j2 vulnerability

#22

Post by Quekid5 »

rfd4sgmk8u wrote: post #17
mnd999 wrote: post #11

Earlier quoted context omitted.

CVE doesn’t have much credibility at this point as far as I’m concerned. It can mean anything.

Hang about. You may have misunderstood what CVE is. CVE doesn't mean 'world ending vulnerability'. It means "common vulnerability and exposure". It is merely a way of tagging security vulnerabilities through multiple products. Before CVE it was difficult to reason if a product was insecure because it had a an insecure component. CVE speaks to nothing of the severity (that CVSS), just that two products that have the s…

This one is pretty milquetoast. Clickbait-y title to it, even.

Re: New Log4j2 vulnerability

#23

Post by Sebguer »

mnd999 wrote: post #18
rfd4sgmk8u wrote: post #17

Earlier quoted context omitted.

Hang about. You may have misunderstood what CVE is. CVE doesn't mean 'world ending vulnerability'. It means "common vulnerability and exposure". It is merely a way of tagging security vulnerabilities through multiple products. Before CVE it was difficult to reason if a product was insecure because it had a an insecure component. CVE speaks to nothing of the severity (that CVSS), just that two products that have the s…

Whether I misunderstand it or not (I don’t) is irrelevant because customers run scanning tools and demand fixes for any CVE without attempting to understand them.

That's fair, but it's not really the fault of MITRE / the CVE database, it's the fact that people have been incentivized to submit these. Similar conversations have come up around how NPM handles vulnerability reports, since they treat all vulnerabilities the same, including very low-risk ones like DoS risks that require control of your build pipeline.

The problem is compounded in cases like Log4j where not even the CVE score can be trusted, or in cases you're describing where end-users don't understand CVE itself and only know it in the context of these 'world-ending' vulnerabilities.

Re: New Log4j2 vulnerability

#24

Post by rfd4sgmk8u »

mnd999 wrote: post #18
rfd4sgmk8u wrote: post #17

Earlier quoted context omitted.

Hang about. You may have misunderstood what CVE is. CVE doesn't mean 'world ending vulnerability'. It means "common vulnerability and exposure". It is merely a way of tagging security vulnerabilities through multiple products. Before CVE it was difficult to reason if a product was insecure because it had a an insecure component. CVE speaks to nothing of the severity (that CVSS), just that two products that have the s…

Whether I misunderstand it or not (I don’t) is irrelevant because customers run scanning tools and demand fixes for any CVE without attempting to understand them.

So, you either explain to the customer about how the CVE is out of scope in this context due to the various mitigations or lack of exploitability, or you patch it. Every CVE is real, and should be addressed. Your customers pay you to help them understand it.

Re: New Log4j2 vulnerability

#25

Post by oars »

Please update the title to indicate this is a low severity CVE and prevent managers around the world from panicking and summoning their developers and engineers back at work during this shut down period.

To be honest, I panicked reading this title when I opened HN this evening, but reading the CVE entry tells me this isn't anywhere close to as serious as CVE-44228.

You have a responsibility to not just share information on HN, but to share it in an accurate and well thought manner.

Re: New Log4j2 vulnerability

#26

Post by mongol »

jfoutz wrote: post #21
alfiedotwtf wrote: post #13

Earlier quoted context omitted.

Holy moly, how was that ever a good idea. Just like routers being able to be configured via the manufacturer's website, config by someone other than you seems like a big red flag

well log4j will be old enough to drink in a few weeks (January 8, 2001). It's way older than bcfg2 or ansible, chef, puppet, etc. I'm not sure when the functionality was added. I'd bet it was the bees knees at the time.

Sad that it should be retired now when it is coming of age.

Re: New Log4j2 vulnerability

#28

Post by rst »

johnisgood wrote: post #12
formerly_proven wrote: post #4

Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.

> Most app server configuration files allow you to load and run arbitrary code I do not understand this. Configuration files allow you to load and run arbitrary code? Is this actually a thing? What are they using for configuration files?! Tcl?

In a typical installation of something like Apache Tomcat, there will be config files that tell the server what code to load and run. If you can modify those config files...

Re: New Log4j2 vulnerability

#29

Post by filleokus »

johnisgood wrote: post #12
formerly_proven wrote: post #4

Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.

> Most app server configuration files allow you to load and run arbitrary code I do not understand this. Configuration files allow you to load and run arbitrary code? Is this actually a thing? What are they using for configuration files?! Tcl?

If I remember correctly e.g Django and Flask uses plain old python-files for configs. Don’t know if it’s common in the Node landscape but probably?

I don’t know how common it is to specify paths to/file name for DLL’s in config to load at runtime for C#, but probably not totally unheard of? And if you can edit the config, maybe you can place a DLL somewhere as well…?

(But at the some time if you can edit the config, maybe you can just replace/patch the main binary in the first place…)

Re: New Log4j2 vulnerability

#30

Post by rfd4sgmk8u »

Sebguer wrote: post #23
mnd999 wrote: post #18

Earlier quoted context omitted.

Whether I misunderstand it or not (I don’t) is irrelevant because customers run scanning tools and demand fixes for any CVE without attempting to understand them.

That's fair, but it's not really the fault of MITRE / the CVE database, it's the fact that people have been incentivized to submit these. Similar conversations have come up around how NPM handles vulnerability reports, since they treat all vulnerabilities the same, including very low-risk ones like DoS risks that require control of your build pipeline. The problem is compounded in cases like Log4j where not even the…

The CVSS score cannot be trusted? How so? I don't see why any of the log4j CVE's 'cant be trusted'?
Post reply on HN