{"id":102661,"date":"2021-12-19T03:36:43","date_gmt":"2021-12-19T01:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov"},"modified":"2021-12-19T03:36:43","modified_gmt":"2021-12-19T01:36:45","slug":"eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","title":{"rendered":"E\u0161te jedna zranite\u013enos\u0165 v Log4j 2. Probl\u00e9my v Log4j sa t\u00fdkaj\u00fa 8% Maven bal\u00edkov.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V kni\u017enici Log4j 2 bola zisten\u00e1 \u010fal\u0161ia zranite\u013enos\u0165 (CVE-2021-45105), ktor\u00e1, na rozdiel od dvoch predch\u00e1dzaj\u00facich probl\u00e9mov, patr\u00ed do kateg\u00f3rie nebezpe\u010dn\u00fdch, av\u0161ak nie kritick\u00fdch. Nov\u00fd probl\u00e9m umo\u017e\u0148uje vyvola\u0165 odmietnutie slu\u017eby a prejavuje sa v podobe cyklenia a havarijn\u00e9ho ukon\u010denia pri spracovan\u00ed ur\u010dit\u00fdch re\u0165azcov. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 v publikovanej verzii Log4j 2.17, ktor\u00e1 bola zverejnen\u00e1 pred nieko\u013ek\u00fdmi hodinami. Nebezpe\u010dnos\u0165 zranite\u013enosti zmier\u0148uje fakt, \u017ee probl\u00e9m sa prejavuje iba na syst\u00e9moch s Java 8. <\/p>\n
Zranite\u013enosti sa t\u00fdkaj\u00fa syst\u00e9mov, ktor\u00e9 pri ur\u010dovan\u00ed form\u00e1tu v\u00fdstupu do logu pou\u017e\u00edvaj\u00fa kontextov\u00e9 dotazy (Context Lookup), ako ${ctx:var}. V verzi\u00e1ch Log4j od 2.0-alpha1 do 2.16.0 ch\u00fdbala ochrana pred nekontrolovanou rekurziou, \u010do umo\u017enilo \u00fato\u010dn\u00edkovi manipul\u00e1ciou s hodnotou pou\u017eitou pri substit\u00facii vyvola\u0165 cyklenie, ved\u00face k vy\u010derpaniu miesta na z\u00e1sobn\u00edku a hav\u00e1rii procesu. Probl\u00e9m sa konkr\u00e9tne vyskytoval pri substit\u00facii tak\u00fdch hodn\u00f4t, ako «${${::-${::-$${::-j}}}}». <\/p>\n
Navy\u0161e je treba poznamena\u0165, \u017ee v\u00fdskumn\u00edci z firmy Blumira navrhli variant \u00fatoku na zranite\u013en\u00e9 Java aplik\u00e1cie, ktor\u00e9 neprij\u00edmaj\u00fa extern\u00e9 sie\u0165ov\u00e9 po\u017eiadavky. Napr\u00edklad je mo\u017en\u00e9 za\u00fato\u010di\u0165 t\u00fdmto sp\u00f4sobom na syst\u00e9my v\u00fdvoj\u00e1rov alebo pou\u017e\u00edvate\u013eov Java aplik\u00e1ci\u00ed. Podstata met\u00f3dy spo\u010d\u00edva v tom, \u017ee ak s\u00fa na syst\u00e9me pou\u017e\u00edvate\u013ea zranite\u013en\u00e9 Java procesy, ktor\u00e9 prij\u00edmaj\u00fa sie\u0165ov\u00e9 pripojenia iba z lok\u00e1lneho hostite\u013ea (localhost), alebo spracov\u00e1vaj\u00fa RMI po\u017eiadavky (Remote Method Invocation, port 1099), \u00fatok m\u00f4\u017ee by\u0165 vykonan\u00fd JavaScriptov\u00fdm k\u00f3dom, ktor\u00fd sa vykon\u00e1va pri otvoren\u00ed \u0161kodlivej str\u00e1nky v prehliada\u010di. Na organiz\u00e1ciu pripojenia k sie\u0165ov\u00e9mu portu Java aplik\u00e1cie pri podobnom \u00fatoku sa pou\u017e\u00edva API WebSocket, na ktor\u00e9 sa na rozdiel od HTTP po\u017eiadaviek nevz\u0165ahuj\u00fa obmedzenia same-origin (WebSocket sa m\u00f4\u017ee tie\u017e pou\u017ei\u0165 na skenovanie sie\u0165ov\u00fdch portov na lok\u00e1lnom hostite\u013eovi s cie\u013eom zisti\u0165 dostupn\u00e9 sie\u0165ov\u00e9 spracovatele).
<\/center> <\/p>\n
Zverejnen\u00e9 v\u00fdsledky hodnotenia zranite\u013enosti kni\u017en\u00edc s\u00favisiacich so z\u00e1vislos\u0165ami na Log4j, ktor\u00e9 vydala spolo\u010dnos\u0165 Google, s\u00fa tie\u017e zauj\u00edmav\u00e9. Pod\u013ea Googlu sa probl\u00e9m t\u00fdka 8% zo v\u0161etk\u00fdch bal\u00edkov v repozit\u00e1ri Maven Central. Konkr\u00e9tne sa zranite\u013enosti t\u00fdkali 35863 Java bal\u00edkov, ktor\u00e9 s\u00fa priamo alebo nepriamo spojen\u00e9 s Log4j. Z toho je Log4j pou\u017eit\u00fd ako priama z\u00e1vislos\u0165 prv\u00e9ho stup\u0148a iba v 17% pr\u00edpadov, zatia\u013e \u010do v 83% zranite\u013en\u00fdch bal\u00edkov sa v\u00e4zba vykon\u00e1va prostredn\u00edctvom medziproduktov z\u00e1visl\u00fdch na Log4j, t.j. z\u00e1vislosti druh\u00e9ho a vy\u0161\u0161ieho stup\u0148a (21% - druh\u00e9ho, 12% - tretieho, 14% - \u0161tvrt\u00e9ho, 26% - piateho, 6% - \u0161iesteho). R\u00fdchlos\u0165 opravy zranite\u013enosti zatia\u013e nech\u00e1va ve\u013ea \u017eelania; t\u00fd\u017ede\u0148 po odhalen\u00ed zranite\u013enosti bolo z 35863 identifikovan\u00fdch bal\u00edkov probl\u00e9m odstr\u00e1nen\u00fd zatia\u013e iba v 4620, t.j. v 13%.
<\/center> <\/p>\n
Medzit\u00fdm, \u00darad pre kybernetick\u00fa bezpe\u010dnos\u0165 a ochranu infra\u0161trukt\u00fary USA zverejnil n\u00fadzov\u00fd pokyn, ktor\u00fd vy\u017eaduje od feder\u00e1lnych agent\u00far vykona\u0165 ur\u010denie informa\u010dn\u00fdch syst\u00e9mov, ktor\u00e9 s\u00fa n\u00e1chyln\u00e9 na zranite\u013enos\u0165 Log4j, a do 23. decembra nain\u0161talova\u0165 aktualiz\u00e1cie na blokovanie probl\u00e9mu. Do 28. decembra musia organiz\u00e1cie vykona\u0165 hl\u00e1senie o vykonanej pr\u00e1ci. Na zjednodu\u0161enie identifik\u00e1cie probl\u00e9mov\u00fdch syst\u00e9mov bol pripraven\u00fd zoznam produktov, v ktor\u00fdch sa potvrdila existencia zranite\u013enosti (v zozname je viac ako 23 000 aplik\u00e1ci\u00ed). \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"E\u0161te](\"\/wp-content\/uploads\/2021\/12\/811931e8c3ae3f3f3c2e81db361034e6.jpg\")
<\/center> <\/p>\n![\"E\u0161te](\"\/wp-content\/uploads\/2021\/12\/1e61b09923c7e055fa635545f1b3de6b.jpg\")
<\/center> <\/p>\n