{"id":102661,"date":"2021-12-19T03:36:43","date_gmt":"2021-12-19T01:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov"},"modified":"2021-12-19T03:36:43","modified_gmt":"2021-12-19T01:36:45","slug":"eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","title":{"rendered":"Dal\u0161\u00ed zranitelnost v Log4j 2. Probl\u00e9my v Log4j se t\u00fdkaj\u00ed 8 % bal\u00ed\u010dk\u016f Maven","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V knihovn\u011b Log4j 2 byla objevena dal\u0161\u00ed zranitelnost (CVE-2021-45105), kter\u00e1 se na rozd\u00edl od dvou p\u0159edchoz\u00edch probl\u00e9m\u016f \u0159ad\u00ed mezi nebezpe\u010dn\u00e9, ale nikoli kritick\u00e9. Nov\u00fd probl\u00e9m umo\u017e\u0148uje vyvolat odm\u00edtnut\u00ed slu\u017eby a projevuje se jako cyklen\u00ed a havarov\u00e1n\u00ed p\u0159i zpracov\u00e1n\u00ed ur\u010dit\u00fdch \u0159et\u011bzc\u016f. Zranitelnost byla odstran\u011bna v ned\u00e1vno zve\u0159ejn\u011bn\u00e9m vyd\u00e1n\u00ed Log4j 2.17. Nebezpe\u010d\u00ed zranitelnosti zm\u00edr\u0148uje to, \u017ee probl\u00e9m se projevuje pouze na syst\u00e9mech s Java 8. <\/p>\n
Syst\u00e9my pou\u017e\u00edvaj\u00edc\u00ed kontextov\u00e9 dotazy (Context Lookup) pro ur\u010den\u00ed form\u00e1tu v\u00fdstupu do logu, jako je ${ctx:var}, jsou n\u00e1chyln\u00e9 k zranitelnostem. V verz\u00edch Log4j od 2.0-alpha1 a\u017e po 2.16.0 chyb\u011bla ochrana proti nekontrolovan\u00e9 rekurzi, co\u017e \u00fato\u010dn\u00edkovi umo\u017enilo manipulac\u00ed s hodnotou pou\u017eit\u00e9 p\u0159i substituci zp\u016fsobit nekone\u010dn\u00e9 cyklen\u00ed, vedouc\u00ed k vy\u010derp\u00e1n\u00ed z\u00e1sobn\u00edku a hav\u00e1rii procesu. Zejm\u00e9na se probl\u00e9m vyskytoval p\u0159i substituci takov\u00fdch hodnot jako «${${::-${::-$${::-j}}}}». <\/p>\n
D\u00e1le lze zm\u00ednit, \u017ee v\u00fdzkumn\u00edci z firmy Blumira navrhli variantu \u00fatoku na zraniteln\u00e9 Java aplikace, kter\u00e9 nep\u0159ij\u00edmaj\u00ed extern\u00ed s\u00ed\u0165ov\u00e9 dotazy. Nap\u0159\u00edklad je mo\u017en\u00e9 t\u00edmto zp\u016fsobem napadnout syst\u00e9my v\u00fdvoj\u00e1\u0159\u016f nebo u\u017eivatel\u016f Java aplikac\u00ed. Podstata metody spo\u010d\u00edv\u00e1 v tom, \u017ee pokud m\u00e1 u\u017eivatel na sv\u00e9m syst\u00e9mu zraniteln\u00e9 Java procesy, kter\u00e9 p\u0159ij\u00edmaj\u00ed s\u00ed\u0165ov\u00e1 spojen\u00ed pouze z m\u00edstn\u00edho hostitele (localhost) nebo zpracov\u00e1vaj\u00ed RMI dotazy (Remote Method Invocation, port 1099), m\u016f\u017ee b\u00fdt \u00fatok proveden JavaScriptov\u00fdm k\u00f3dem, kter\u00fd se prov\u00e1d\u00ed p\u0159i otev\u0159en\u00ed \u0161kodliv\u00e9 str\u00e1nky v prohl\u00ed\u017ee\u010di u\u017eivatel\u016f. Pro nav\u00e1z\u00e1n\u00ed spojen\u00ed se s\u00ed\u0165ov\u00fdm portem Java aplikace p\u0159i takov\u00e9m \u00fatoku se vyu\u017e\u00edv\u00e1 API WebSocket, pro kter\u00e9 se, na rozd\u00edl od HTTP dotaz\u016f, neuplat\u0148uj\u00ed \u017e\u00e1dn\u00e1 omezen\u00ed same-origin (WebSocket lze tak\u00e9 pou\u017e\u00edt ke skenov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch port\u016f na m\u00edstn\u00edm hostiteli za \u00fa\u010delem ur\u010den\u00ed dostupn\u00fdch s\u00ed\u0165ov\u00fdch obslu\u017en\u00fdch program\u016f).
<\/center> <\/p>\n
Zaj\u00edmav\u00e9 jsou tak\u00e9 v\u00fdsledky hodnocen\u00ed zranitelnosti knihoven souvisej\u00edc\u00edch se z\u00e1vislostmi na Log4j, kter\u00e9 zve\u0159ejnila spole\u010dnost Google. Podle Googlu se probl\u00e9m t\u00fdk\u00e1 8 % v\u0161ech bal\u00ed\u010dk\u016f v repozit\u00e1\u0159i Maven Central. Konkr\u00e9tn\u011b bylo zraniteln\u00fdch 35863 Java bal\u00ed\u010dk\u016f p\u0159\u00edmo a nep\u0159\u00edmo spojen\u00fdch s Log4j. P\u0159i\u010dem\u017e Log4j se pou\u017e\u00edv\u00e1 jako p\u0159\u00edm\u00e1 z\u00e1vislost prvn\u00ed \u00farovn\u011b pouze v 17 % p\u0159\u00edpad\u016f, zat\u00edmco v 83 % zasa\u017een\u00fdch bal\u00ed\u010dk\u016f je vazba realizov\u00e1na prost\u0159ednictv\u00edm mezipam\u011b\u0165ov\u00fdch bal\u00ed\u010dk\u016f, kter\u00e9 z\u00e1vis\u00ed na Log4j, tedy z\u00e1vislost\u00ed druh\u00e9 a vy\u0161\u0161\u00ed \u00farovn\u011b (21 % - druh\u00e9 \u00farovn\u011b, 12 % - t\u0159et\u00ed, 14 % - \u010dtvrt\u00e9, 26 % - p\u00e1t\u00e9, 6 % - \u0161est\u00e9). Tempo opravy zranitelnost\u00ed zat\u00edm zanech\u00e1v\u00e1 mnoho p\u0159\u00e1n\u00ed, po t\u00fddnu od zji\u0161t\u011bn\u00ed zranitelnosti bylo probl\u00e9m odstran\u011bno pouze ve 4620 z 35863 zji\u0161t\u011bn\u00fdch bal\u00ed\u010dk\u016f, tedy v 13 %.
<\/center> <\/p>\n
Mezit\u00edm americk\u00e1 Agentura pro kybernetickou bezpe\u010dnost a ochranu infrastruktury zve\u0159ejnila nal\u00e9havou sm\u011brnici, kter\u00e1 na\u0159izuje feder\u00e1ln\u00edm agentur\u00e1m identifikovat informa\u010dn\u00ed syst\u00e9my zraniteln\u00e9 v\u016f\u010di Log4j a do 23. prosince prov\u00e9st instalaci aktualizac\u00ed, kter\u00e9 probl\u00e9m zablokuj\u00ed. Do 28. prosince maj\u00ed organizace pod\u00e1vat zpr\u00e1vy o vykonan\u00e9 pr\u00e1ci. Aby se usnadnilo odhalov\u00e1n\u00ed probl\u00e9mov\u00fdch syst\u00e9m\u016f, byl vypracov\u00e1n seznam produkt\u016f, u kter\u00fdch byla potvrzena zranitelnost (seznam zahrnuje v\u00edce ne\u017e 23 tis\u00edc aplikac\u00ed). \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Dal\u0161\u00ed](\"\/wp-content\/uploads\/2021\/12\/811931e8c3ae3f3f3c2e81db361034e6.jpg\")
<\/center> <\/p>\n![\"Dal\u0161\u00ed](\"\/wp-content\/uploads\/2021\/12\/1e61b09923c7e055fa635545f1b3de6b.jpg\")
<\/center> <\/p>\n