{"id":750,"date":"2021-12-17T14:33:36","date_gmt":"2021-12-17T14:33:36","guid":{"rendered":"https:\/\/sites.rutgers.edu\/soc\/?page_id=750"},"modified":"2022-01-07T17:32:18","modified_gmt":"2022-01-07T17:32:18","slug":"log4j-alert","status":"publish","type":"page","link":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/","title":{"rendered":"Alert: Apache Log4J Utility Vulnerability"},"content":{"rendered":"<p>Version 1.2 Published 1\/4\/2021 8:00AM [Added RCE risk for version 2.17 to New Information]<\/p>\n<p>Version 1.1 Published 12\/19\/2021 4:00PM [Added DDOS risk for version 2.16 to New Information]<\/p>\n<p>Version 1.0 Published 12\/17\/2021 12:00PM [Initial Publication]<\/p>\n<p><strong>Summary:<\/strong><br class=\"\" \/>The Log4J vulnerability is a critical vulnerability that allows for Remote-Code-Execution on an impacted device.\u00a0 If any user-controlled input is sent to a vulnerable service, and logged, then that device can be forced to run any arbitrary code as the user of the impacted service.\u00a0 \u00a0Typical examples of malicious payload would be keyloggers, rootkits, and ransomware.\u00a0 Because this library is present in many commercial and home-grown applications it is critical to review\u00a0<strong>ALL<\/strong>\u00a0IT assets for this vulnerability.\u00a0 As new versions of these exploits are discovered, the mitigations and list of impacted products are constantly changed, so IT staff must monitor and adapt to the changing threat landscape.<\/p>\n<p><strong>What should you be doing:<\/strong><\/p>\n<ul>\n<li>Search ALL systems under your control for the presence of the Log4J libraries\n<ul>\n<li>Mitigate where possible.<\/li>\n<li>Where found, results should be reported on this WebForm:\u00a0<a href=\"https:\/\/go.rutgers.edu\/Log4JExpInv\">https:\/\/go.rutgers.edu\/Log4JExpInv<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Look for vulnerable products from ALL IT vendors you use\n<ul>\n<li>The Log4J library is widely distributed and can be embedded in unexpected places.\u00a0 Even ILO tools on server hardware runs a webserver and can contain the issue.\u00a0 It is also present in a number of commercial software packages.\u00a0 We have found it in our backup software, and even some science software.<\/li>\n<li>Where found, results should be reported on this WebForm:\u00a0<a href=\"https:\/\/go.rutgers.edu\/Log4JExpInv\">https:\/\/go.rutgers.edu\/Log4JExpInv<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Look for Vulnerable Products from hosted cloud solutions\n<ul>\n<li>While not hosted on campus, these systems still represent risk to the University and must be evaluated.<\/li>\n<li>Where found, results should be reported on this WebForm:\u00a0<a href=\"https:\/\/go.rutgers.edu\/Log4JExpInv\">https:\/\/go.rutgers.edu\/Log4JExpInv<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Continue to monitor the\u00a0<a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\">Log4J Security Page<\/a>\u00a0and\u00a0<a href=\"https:\/\/www.rumble.run\/blog\/finding-log4j\/\">Vendor patches<\/a>\u00a0for updates\n<ul>\n<li>This situation is rapidly evolving, so its important to keep checking for new information.\u00a0 EI has already had to re-patch many systems.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>New Information:<\/strong><\/p>\n<p>Version 2.17 (And 2.12.3 for Java 7) and below, are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.\u00a0 This does not impact version 1.x. However, other critical vulnerabilities impact this version and should be mitigated. Version 2.17.1 (and 2.12.4 for Java 7) have been released to address this new flaw.<\/p>\n<p>Version 2.16 (and 2.12.2 for Java 7) was found to be susceptible to uncontrolled recursion to self-referential lookups.\u00a0 This would allow an attacker to crash a running application as a form of denial of service.\u00a0 Version 2.17 (And 2.12.3 for Java 7) have been released to address the new flaws.\u00a0 The Log4J Security Page lists some possible mitigations, but upgrading is the preferred full mitigation.<\/p>\n<p>Note: Previous workarounds involving configuration changes to affected versions are no longer sufficient.<\/p>\n<p><strong>Helpful links:<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\">Log4J Security Page<\/a><\/li>\n<li><a href=\"https:\/\/software.rutgers.edu\/index\/\">List of links for Rutgers Software sold via the portal<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/cisagov\/log4j-affected-db\/blob\/develop\/SOFTWARE-LIST.md\">CISA Log4j (CVE-2021-44228) Affected Vendor &amp; Software List<\/a><\/li>\n<li><a href=\"https:\/\/www.rumble.run\/blog\/finding-log4j\/\">List of links to Vendor Pages for this issue<\/a><\/li>\n<\/ul>\n<p><iframe loading=\"lazy\" title=\"Log4J Demo\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/p0SmFJWL0N4?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/p>\n<p><strong>Decision tree EI used on its own systems:<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-803 size-full alignnone\" src=\"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png\" alt=\"\" width=\"747\" height=\"639\" srcset=\"https:\/\/sites.rutgers.edu\/soc-archive\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png 747w, https:\/\/sites.rutgers.edu\/soc-archive\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree-300x257.png 300w\" sizes=\"(max-width: 747px) 100vw, 747px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h5>Search Scripts<\/h5>\n<p><a href=\"https:\/\/sites.rutgers.edu\/soc\/log4j-centos-script\/\">CentOS Script<\/a><br \/>\n<a href=\"https:\/\/sites.rutgers.edu\/soc\/log4j-windows-script\/\">Windows Script<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Version 1.2 Published 1\/4\/2021 8:00AM [Added RCE risk for version 2.17 to New Information] Version 1.1 Published 12\/19\/2021 4:00PM [Added DDOS risk for version 2.16 to New Information] Version 1.0 &hellip; <a href=\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/\" class=\"\">Read More<\/a><\/p>\n","protected":false},"author":112,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-custom.php","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-750","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Alert: Apache Log4J Utility Vulnerability - Security Operations Center<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Alert: Apache Log4J Utility Vulnerability - Security Operations Center\" \/>\n<meta property=\"og:description\" content=\"Version 1.2 Published 1\/4\/2021 8:00AM [Added RCE risk for version 2.17 to New Information] Version 1.1 Published 12\/19\/2021 4:00PM [Added DDOS risk for version 2.16 to New Information] Version 1.0 &hellip; Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/\" \/>\n<meta property=\"og:site_name\" content=\"Security Operations Center\" \/>\n<meta property=\"article:modified_time\" content=\"2022-01-07T17:32:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/\",\"url\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/\",\"name\":\"Alert: Apache Log4J Utility Vulnerability - Security Operations Center\",\"isPartOf\":{\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png\",\"datePublished\":\"2021-12-17T14:33:36+00:00\",\"dateModified\":\"2022-01-07T17:32:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#primaryimage\",\"url\":\"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png\",\"contentUrl\":\"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/sites.rutgers.edu\/soc-archive\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Alert: Apache Log4J Utility Vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/sites.rutgers.edu\/soc-archive\/#website\",\"url\":\"https:\/\/sites.rutgers.edu\/soc-archive\/\",\"name\":\"Security Operations Center\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/sites.rutgers.edu\/soc-archive\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Alert: Apache Log4J Utility Vulnerability - Security Operations Center","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/","og_locale":"en_US","og_type":"article","og_title":"Alert: Apache Log4J Utility Vulnerability - Security Operations Center","og_description":"Version 1.2 Published 1\/4\/2021 8:00AM [Added RCE risk for version 2.17 to New Information] Version 1.1 Published 12\/19\/2021 4:00PM [Added DDOS risk for version 2.16 to New Information] Version 1.0 &hellip; Read More","og_url":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/","og_site_name":"Security Operations Center","article_modified_time":"2022-01-07T17:32:18+00:00","og_image":[{"url":"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/","url":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/","name":"Alert: Apache Log4J Utility Vulnerability - Security Operations Center","isPartOf":{"@id":"https:\/\/sites.rutgers.edu\/soc-archive\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#primaryimage"},"image":{"@id":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#primaryimage"},"thumbnailUrl":"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png","datePublished":"2021-12-17T14:33:36+00:00","dateModified":"2022-01-07T17:32:18+00:00","breadcrumb":{"@id":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#primaryimage","url":"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png","contentUrl":"https:\/\/sites.rutgers.edu\/soc\/wp-content\/uploads\/sites\/72\/2021\/12\/log4J-tree.png"},{"@type":"BreadcrumbList","@id":"https:\/\/sites.rutgers.edu\/soc-archive\/log4j-alert\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sites.rutgers.edu\/soc-archive\/"},{"@type":"ListItem","position":2,"name":"Alert: Apache Log4J Utility Vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/sites.rutgers.edu\/soc-archive\/#website","url":"https:\/\/sites.rutgers.edu\/soc-archive\/","name":"Security Operations Center","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sites.rutgers.edu\/soc-archive\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/pages\/750"}],"collection":[{"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/users\/112"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/comments?post=750"}],"version-history":[{"count":21,"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/pages\/750\/revisions"}],"predecessor-version":[{"id":820,"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/pages\/750\/revisions\/820"}],"wp:attachment":[{"href":"https:\/\/sites.rutgers.edu\/soc-archive\/wp-json\/wp\/v2\/media?parent=750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}