{"id":102661,"date":"2021-12-19T03:36:43","date_gmt":"2021-12-19T01:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov"},"modified":"2021-12-19T03:36:43","modified_gmt":"2021-12-19T01:36:45","slug":"eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","title":{"rendered":"Veel \u00fcks Log4j 2 haavatavus. Log4j probleemid m\u00f5jutavad 8% Maven-pakettidest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Log4j 2 raamatukogus tuvastati veel \u00fcks haavatavus (CVE-2021-45105), mis erineb kahest eelmisest probleemist, kuna see on klassifitseeritud ohtlikuks, kuid mitte kriitiliseks. Uus probleem v\u00f5imaldab k\u00e4ivitada teenuse katkestamise ja avaldub spetsiifiliste stringide t\u00f6\u00f6tlemisel silmuste ja ootamatute l\u00f5petamiste n\u00e4ol. Haavatavus on k\u00f5rvaldatud \u00e4sja avaldatud versioonis Log4j 2.17. Haavatavuse ohtu leevendab asjaolu, et probleem ilmneb ainult Java 8 s\u00fcsteemides. <\/p>\n

Haavatavustest on m\u00f5jutatud s\u00fcsteemid, mis kasutavad kontekstilisi p\u00e4ringuid (Context Lookup) logifaili v\u00e4ljundvormingute m\u00e4\u00e4ramiseks, nagu ${ctx:var}. Log4j versioonides alates 2.0-alpha1 kuni 2.16.0 puudus kaitse kontrollimata rekursiooni eest, mis v\u00f5imaldas r\u00fcndajal manipuleerida asendusteks kasutatava v\u00e4\u00e4rtusega, p\u00f5hjustades l\u00f5pmatu ts\u00fckli, mis viis m\u00e4lukoha ammendumiseni ja protsessi kokkuvarisemiseni. Eriti probleem tekkis selliste v\u00e4\u00e4rtuste asendamisel nagu «${${::-${::-$${::-j}}}}». <\/p>\n

Lisaks v\u00e4\u00e4rib m\u00e4rkimist, et Blumira ettev\u00f5tte teadlased pakkusid v\u00e4lja r\u00fcnnakumeetodi haavatavate Java-rakenduste vastu, mis ei v\u00f5ta vastu v\u00e4liseid v\u00f5rgu p\u00e4ringuid. N\u00e4iteks on v\u00f5imalik r\u00fcnnata arendajate v\u00f5i Java-rakenduste kasutajate s\u00fcsteeme. Meetodi tuum seisneb selles, et juhul kui kasutaja s\u00fcsteemis on haavatavad Java-protsessid, mis aktsepteerivad v\u00f5rgu\u00fchendusi ainult kohalikult (localhost) v\u00f5i t\u00f6\u00f6tlevad RMI-p\u00e4ringuid (Remote Method Invocation, port 1099), v\u00f5ib r\u00fcnnaku teha JavaScripti koodiga, mis t\u00e4idetakse, kui kasutajad avavad brauseris pahatahtliku lehe. T\u00fchiku korraldamiseks Java-rakenduse v\u00f5rguportiga sellise r\u00fcnnaku puhul kasutatakse WebSocket API-d, mis erinevalt HTTP-p\u00e4ringutest ei allu same-origin piirangutele (WebSocketi saab kasutada ka lokaalse hosti v\u00f5rguportide skaneerimiseks, et tuvastada olemasolevad v\u00f5rgu t\u00f6\u00f6tlijad).

\"Veel<\/center> <\/p>\n

Samuti on huvitavad Google'i poolt avaldatud tulemused Log4j'ga seotud teekide haavatavuse hindamisest. Google'ste kohaselt m\u00f5jutab probleem 8% k\u00f5ikidest paketidest Maven Central'i raadios. Eriti on haavatavused leitud 35863 Java-paketist, mis on otsese ja kaudse s\u00f5ltuvusega Log4j'st. Siiski kasutatakse Log4j-d otsese esimese taseme s\u00f5ltuvusena ainult 17% juhtudest, samas kui 83% haavatavusega katvad paketid on seotud Log4j kaudu vahepakettide, st teise ja k\u00f5rgema taseme s\u00f5ltuvustega (21% - teise taseme, 12% - kolmanda, 14% - neljanda, 26% - viienda, 6% - kuuenda). Haavatavuste parandamise kiirus j\u00e4tab siiski soovida, kuna n\u00e4dal p\u00e4rast haavatavuse avastamist on 35863 tuvastatud paketist probleem lahendatud vaid 4620-s, st 13% juhtudest.

\"Veel<\/center> <\/p>\n

Vahepeal on Ameerika \u00dchendriikide K\u00fcberturvalisuse ja Infra- ning Tehnoloogiaministeerium v\u00e4lja andnud erakorralise direktiivi, mis n\u00f5uab f\u00f6deraalse agentuuride tuvastamist Log4j haavatavusele allutatud teabe s\u00fcsteemide osas ning nende s\u00fcsteemide t\u00e4iendavate uuenduste rakendamist hiljemalt 23. detsembriks. Kuni 28. detsembrini peavad organisatsioonid aru andma tehtud t\u00f6\u00f6st. Probleemsete s\u00fcsteemide tuvastamise lihtsustamiseks on koostatud loetelu toodetest, kus on kinnitatud haavatavuse ilmnemine (loendis on \u00fcle 23 000 rakenduse).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45105), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u0434\u0432\u0443\u0445 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u0430 \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445. \u041d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Log4j 2.17. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0433\u043b\u0430\u0436\u0438\u0432\u0430\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102662,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102661","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Veel \u00fcks haavatavus Log4j 2-s. Log4j probleemid m\u00f5jutavad 8% Maven pakettidest | ProHoster","description":"Log4j 2 teegis on avastatud veel \u00fcks haavatavus (CVE-2021-45105), mis erineb kahest eelmisest probleemist, kuna seda klassifitseeritakse ohtlikuks, kuid mitte kriitiliseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Log4j 2. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 Log4j \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 8% Maven-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45105), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u0434\u0432\u0443\u0445 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u0430 \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-19T01:36:45+00:00","article:modified_time":"2021-12-19T01:36:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102661","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-19 01:36:58","updated":"2022-09-30 09:32:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102661"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102661\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/102662"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}