vulnerabilities Critical vulnerability in Apache Log4j library Researchers discovered a critical vulnerability in Apache Log4j library, which scores perfect 10 out of 10 in CVSS. Here’s how to protect against it. Nikolay Pankov December 11, 2021 Various information security news outlets reported on the discovery of critical vulnerability CVE-2021-44228 in the Apache Log4j library (CVSS severity level 10 out of 10). Millions of Java applications use this library to log error messages. To make matters worse, attackers are already actively exploiting this vulnerability. For this reason, the Apache Foundation recommends all developers to update the library to version 2.15.0, and if this is not possible, use one of the methods described on the Apache Log4j Security Vulnerabilities page. Why CVE-2021-44228 is so dangerous CVE-2021-44228, also named Log4Shell or LogJam, is a Remote Code Execution (RCE) class vulnerability. If attackers manage to exploit it on one of the servers, they gain the ability to execute arbitrary code and potentially take full control of the system. What makes CVE-2021-44228 especially dangerous is the ease of exploitation: even an inexperienced hacker can successfully execute an attack using this vulnerability. According to the researchers, attackers only need to force the application to write just one string to the log, and after that they are able to upload their own code into the application due to the message lookup substitution function. Working Proofs of Concept (PoC) for the attacks via CVE-2021-44228 are already available on the Internet. Therefore, it’s not surprising that cybersecurity companies are already registering massive network scans for vulnerable applications as well as attacks on honeypots. This vulnerability was discovered by Chen Zhaojun of Alibaba Cloud Security Team. What is Apache Log4J and why is this library is so popular? Apache Log4j is part of the Apache Logging Project. By and large, usage of this library is one of the easiest ways to log errors, and that is why most Java developers use it. Many large software companies and online services use the Log4j library, including Amazon, Apple iCloud, Cisco, Cloudflare, ElasticSearch, Red Hat, Steam, Tesla, Twitter, and many more. Because of the library being so popular, some information security researchers expect a significant increase in the attacks on vulnerable servers over the coming days. #Log4Shell pic.twitter.com/1bKDwRQBqt — Florian Roth (@cyb3rops) December 10, 2021 Which versions of the Log4j library is vulnerable and how can you protect your servers from attack? Almost all versions of Log4j are vulnerable, starting from 2.0-beta9 to 2.14.1. The simplest and most effective protection method is to install the most recent version of the library, 2.15.0. You can download it on the project page. If for some reason updating the library is not possible, Apache Foundation recommends using one of the mitigation methods. In case of Log4J versions from 2.10 to 2.14.1, they advise setting the log4j2.formatMsgNoLookups system property, or setting the LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable to true. To protect earlier releases of Log4j (from 2.0-beta9 to 2.10.0), the library developers recommend removing the JndiLookup class from the classpath: zip -q -d log4j-core – *. Jar org / apache / logging / log4j / core / lookup / JndiLookup .class. In addition, we recommend to install security solutions on your servers — in many cases this will allow you to detect the launch of malicious code and stop the attack’s development. You can find more information about Log2shell vulnerabilities here: The Log4Shell Vulnerability – explained: how to stay secure from Kaspersky
Read next Five steps to prevent IT security team burnout A practical guide for chief information security officers and security operation center managers.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.