{"id":102661,"date":"2021-12-19T03:36:43","date_gmt":"2021-12-19T01:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov"},"modified":"2021-12-19T03:36:43","modified_gmt":"2021-12-19T01:36:45","slug":"eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","title":{"rendered":"\u00cenc\u0103 o vulnerabilitate \u00een Log4j 2. Problemele din Log4j afecteaz\u0103 8% din pachetele Maven","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen biblioteca Log4j 2 a fost descoperit\u0103 \u00eenc\u0103 o vulnerabilitate (CVE-2021-45105), care, spre deosebire de dou\u0103le probleme anterioare, este clasificat\u0103 ca fiind periculoas\u0103, dar nu critic\u0103. Noua problem\u0103 permite generarea unei interdic\u021bii \u00een serviciu \u0219i se manifest\u0103 prin looping \u0219i opriri nea\u0219teptate \u00een timpul proces\u0103rii anumitor \u0219iruri. Vulnerabilitatea a fost remediate \u00een versiunea Log4j 2.17 publicat\u0103 cu c\u00e2teva ore \u00een urm\u0103. Pericolul vulnerabilit\u0103\u021bii este atenuat de faptul c\u0103 problema apare doar pe sistemele cu Java 8. <\/p>\n

Sistemele care folosesc cereri de context (Context Lookup) pentru a determina formatul de ie\u0219ire \u00een log sunt vulnerabile, cum ar fi ${ctx:var}. Versiuni Log4j \u00eentre 2.0-alpha1 \u0219i 2.16.0 nu ofereau protec\u021bie \u00eempotriva recursivit\u0103\u021bii necontrolate, ceea ce permitea unui atacator, prin manipularea valorii utilizate pentru substitu\u021bie, s\u0103 provoace o bucl\u0103 infinit\u0103, duc\u00e2nd la epuizarea spa\u021biului din stiv\u0103 \u0219i la terminarea anormal\u0103 a procesului. \u00cen special, problema ap\u0103rea la substituirea unor valori precum «${${::-${::-$${::-j}}}}». <\/p>\n

De asemenea, cercet\u0103torii de la compania Blumira au propus o variant\u0103 de atac \u00eempotriva aplica\u021biilor Java vulnerabile care nu accept\u0103 cereri externe. De exemplu, sistemele dezvoltatorilor sau utilizatorilor de aplica\u021bii Java pot fi atacate \u00een acest fel. Esen\u021ba metodei este aceea c\u0103, \u00een condi\u021biile \u00een care pe sistemul utilizatorului exist\u0103 procese Java vulnerabile ce accept\u0103 conexiuni doar de la gazda local\u0103 (localhost) sau care proceseaz\u0103 cereri RMI (Remote Method Invocation, port 1099), atacul poate fi realizat prin cod JavaScript care este executat c\u00e2nd utilizatorul deschide o pagin\u0103 web mali\u021bioas\u0103 \u00een browser. Pentru a organiza conexiunea cu portul re\u021belei aplica\u021biei Java \u00een timpul unui astfel de atac, se folose\u0219te API WebSocket, care, spre deosebire de cererile HTTP, nu are restric\u021bii de aceea\u0219i origine (WebSocket poate fi folosit \u0219i pentru scanarea porturilor re\u021belei pe gazda local\u0103 pentru a determina handler-ii re\u021belei disponibili).

\"\u00cenc\u0103<\/center> <\/p>\n

De asemenea, rezultatele evalu\u0103rii vulnerabilit\u0103\u021bilor bibliotecilor legate de Log4j publicate de Google sunt de interes. Conform Google, problema afecteaz\u0103 8% din toate pachetele din repository-ul Maven Central. \u00cen particular, 35863 de pachete Java legate de Log4j sunt expuse la vulnerabilitate prin dependen\u021be directe \u0219i indirecte. Aici, Log4j este utilizat ca dependen\u021b\u0103 direct\u0103 de nivel 1 doar \u00een 17% din cazuri, iar \u00een 83% din pachetele afectate, leg\u0103tura se face prin pachete intermediare care depind de Log4j, adic\u0103 dependen\u021be de nivelul 2 \u0219i superior (21% - nivelul 2, 12% - nivelul 3, 14% - nivelul 4, 26% - nivelul 5, 6% - nivelul 6). Rata de corectare a vulnerabilit\u0103\u021bii las\u0103 de dorit; o s\u0103pt\u0103m\u00e2n\u0103 dup\u0103 descoperirea vulnerabilit\u0103\u021bii, din cele 35863 de pachete identificate, problema a fost rezolvat\u0103 doar \u00een 4620, adic\u0103 13%.

\"\u00cenc\u0103<\/center> <\/p>\n

\u00centre timp, Agen\u021bia pentru Securitatea Cibernetic\u0103 \u0219i Protec\u021bia Infrastructurii din SUA a publicat o directiv\u0103 de urgen\u021b\u0103, oblig\u00e2nd agen\u021biile federale s\u0103 identifice systemele informa\u021bionale vulnerabile la Log4j \u0219i s\u0103 instaleze actualiz\u0103ri pentru a bloca problema p\u00e2n\u0103 pe 23 decembrie. P\u00e2n\u0103 la 28 decembrie, organiza\u021biile trebuie s\u0103 raporteze despre progresele realizate. Pentru a facilita identificarea sistemelor problematice, a fost preg\u0103tit un list\u0103 de produse \u00een care s-a confirmat manifestarea vulnerabilit\u0103\u021bii (lista cuprinde peste 23000 de aplica\u021bii).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45105), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u0434\u0432\u0443\u0445 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u0430 \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445. \u041d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Log4j 2.17. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0433\u043b\u0430\u0436\u0438\u0432\u0430\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102662,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102661","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47O alt\u0103 vulnerabilitate \u00een Log4j 2. Problemele din Log4j afecteaz\u0103 8% din pachetele Maven | ProHoster","description":"\u00cen biblioteca Log4j 2 a fost identificat\u0103 o nou\u0103 vulnerabilitate (CVE-2021-45105), care, spre deosebire de dou\u0103le probleme anterioare, este clasificat\u0103 ca fiind periculoas\u0103, dar nu critic\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Log4j 2. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 Log4j \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 8% Maven-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45105), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u0434\u0432\u0443\u0445 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u0430 \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-19T01:36:45+00:00","article:modified_time":"2021-12-19T01:36:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102661","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-19 01:36:58","updated":"2022-09-30 09:32:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102661"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102661\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/102662"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}