PT-2017-4052 · Apache+2 · Apache Log4J+2
Publicado
2017-04-17
·
Atualizado
2022-06-15
·
CVE-2017-5645
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Log4j versions prior to 2.8.2
Description
The issue is related to the deserialization of log events in Apache Log4j. When using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. This allows a remote attacker to execute arbitrary code.
Recommendations
For versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue.
As a temporary workaround, consider disabling the TCP socket server and UDP socket server until a patch is available.
Restrict access to the log event reception functionality to minimize the risk of exploitation.
Exploit
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Log4J
Centos
Red Hat