{"id":19473,"date":"2021-12-21T09:19:51","date_gmt":"2021-12-21T08:19:51","guid":{"rendered":"https:\/\/relnet.hu\/?p=19473"},"modified":"2022-03-18T10:36:19","modified_gmt":"2022-03-18T09:36:19","slug":"hogyan-erinti-gyartoink-megoldasait-a-log4shell-serulekenyseg-2","status":"publish","type":"post","link":"https:\/\/relnet.hu\/en\/hogyan-erinti-gyartoink-megoldasait-a-log4shell-serulekenyseg-2\/","title":{"rendered":"Hogyan \u00e9rinti gy\u00e1rt\u00f3ink megold\u00e1sait a Log4Shell s\u00e9r\u00fcl\u00e9kenys\u00e9g?"},"content":{"rendered":"<p>A m\u00falt h\u00e9t v\u00e9g\u00e9n k\u00f6rbe j\u00e1rta a vil\u00e1got a h\u00edr az Apache Log4j k\u00f6nyvt\u00e1r 2.0 \u00e9s 2.14.1 k\u00f6z\u00f6tti verzi\u00f3it \u00e9rint\u0151, kritikus kock\u00e1zati besorol\u00e1s\u00fa s\u00e9r\u00fcl\u00e9kenys\u00e9ggel kapcsolatban. Az \u00fcgyben m\u00e9g a Nemzetbiztons\u00e1gi Szakszolg\u00e1lat Kiberv\u00e9delmi Int\u00e9ztete is hivatalos riaszt\u00e1st adott ki.<br \/>\n<br \/>Az Apache Log4j k\u00f6nyvt\u00e1rt t\u00f6bb milli\u00f3 Java alkalmaz\u00e1s haszn\u00e1lja hiba\u00fczenetek napl\u00f3z\u00e1s\u00e1ra. A k\u00f6nyvt\u00e1r s\u00e9r\u00fcl\u00e9kenys\u00e9g\u00e9t a t\u00e1mad\u00f3k m\u00e1ris akt\u00edvan kihaszn\u00e1lj\u00e1k. A CVE-2021-44228 sz\u00e1mon nyilv\u00e1ntart\u00e1sba vett, m\u00e1s n\u00e9ven Log4Shell vagy LogJam s\u00e9r\u00fcl\u00e9kenys\u00e9g hiteles\u00edt\u00e9s n\u00e9lk\u00fcli, tetsz\u0151leges, t\u00e1voli k\u00f3dfuttat\u00e1st, valamint teljes, rendszerszint\u0171 hozz\u00e1f\u00e9r\u00e9st tesz lehet\u0151v\u00e9 a t\u00e1mad\u00f3k sz\u00e1m\u00e1ra. A probl\u00e9ma kik\u00fcsz\u00f6b\u00f6l\u00e9s\u00e9re az Apache Foundation azt javasolja, hogy mindenki friss\u00edtse a Log4j-t a s\u00e9r\u00fcl\u00e9kenys\u00e9gre v\u00e1laszul kiadott leg\u00fajabb, 2.15-\u00f6s verzi\u00f3ra.<br \/>\n<br \/>Most sorra vessz\u00fck, hogy a RelNet \u00e1ltal k\u00e9pviselt gy\u00e1rt\u00f3k k\u00f6z\u00fcl melyeket \u00e9rinti ez a nulladik napi s\u00e9r\u00fcl\u00e9kenys\u00e9g:<br \/>\n<\/p>\n<h5>Juniper Networks<\/h5>\n<p>A Juniper Cloud Workload Protection \u00e9s a Juniper \u00fajgener\u00e1ci\u00f3s SRX t\u0171zfalak \u00fcgyfelei k\u00e9pesek \u00e9szlelni \u00e9s blokkolni a t\u00e1mad\u00e1si k\u00eds\u00e9rleteket, a Juniper Threat Labs pedig folyamatosan figyeli a vari\u00e1ci\u00f3kat, \u00e9s friss\u00edti a szignat\u00fara adatb\u00e1zist.<br \/>\n<br \/>\u2022\tA t\u00e1mogatott SRX eszk\u00f6z\u00f6kre m\u00e1r el\u00e9rhet\u0151 a Log4Shellt \u00e9szlel\u0151 \u00e9s blokkol\u00f3 <a href=\"https:\/\/threatlabs.juniper.net\/home\/search\/#\/details\/?sigtype=ips&amp;sigid=HTTP:APACHE:LOG4J-JNDI-MGNR-RCE\">szignat\u00faraf\u00e1jl<\/a>, amely megv\u00e9di az SRX t\u0171zfalak \u00e1ltal biztos\u00edtott infrastrukt\u00far\u00e1kat az eredeti Log4Shell \u00e9s annak v\u00e1ltozatai ellen is.<br \/>\n<br \/>\u2022\tA Cloud Workload Protectiont futtat\u00f3 alkalmaz\u00e1sok v\u00e9dve vannak a t\u00e1mad\u00e1sokkal szemben. A Log4j s\u00e9r\u00fcl\u00e9kenys\u00e9g\u00e9t kishaszn\u00e1l\u00f3 t\u00e1mad\u00e1si k\u00eds\u00e9rletek a felhaszn\u00e1l\u00f3i fel\u00fcleten bel\u00fcl ker\u00fclnek r\u00f6gz\u00edt\u00e9sre, mint \\&#8221;Server-Side Request Forgery\\&#8221; (SSRF) t\u00e1mad\u00e1sok.<br \/>\n<br \/>\u2022\tA Juniper <a href=\"https:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=JSA11259&amp;cat=SIRT_1&amp;actp=LIST\">r\u00e9szletes list\u00e1t<\/a> bocs\u00e1tott ki a Log4Shell \u00e1ltal nem vesz\u00e9lyeztetett term\u00e9keir\u0151l.<br \/>\n<\/p>\n<h5>Skybox Security<\/h5>\n<p>A Skybox m\u00e9lyrehat\u00f3 elemz\u00e9st hajtott v\u00e9gre az \u00fcgy kapcs\u00e1n a szoftverein. Az eddigi eredm\u00e9nyek szerint:<br \/>\n<br \/>\u2022\tAz \u00f6sszes Skybox rendszerkomponens (Server, Collector, Manager) haszn\u00e1lja a Log4j k\u00f6nyvt\u00e1rat, viszont a Manager s\u00e9r\u00fcl\u00e9kenys\u00e9g\u00e9t nem lehet t\u00e1volr\u00f3l kihaszn\u00e1lni.<br \/>\n<br \/>\u2022\tAz \u00e9rintett Skybox verzi\u00f3k a 11.5.x \u00e9s a 11.6.x, amelyek a Log4j 2.13.2 \u00e9s 2.14.1 verzi\u00f3j\u00e1t haszn\u00e1lj\u00e1k.<br \/>\n<br \/>\u2022\tA 11.4.x \u00e9s kor\u00e1bbi Skybox verzi\u00f3k nincsenek vesz\u00e9lyben.<br \/>\n<br \/>\u2022\tA Skybox jelenleg dolgozik a jav\u00edt\u00f3program elk\u00e9sz\u00edt\u00e9s\u00e9n, de az al\u00e1bbi oldalon olvashat\u00f3 l\u00e9p\u00e9sek szerint az \u00fcgyfelek maguk is elh\u00e1r\u00edthatj\u00e1k a vesz\u00e9lyt a Java konfigur\u00e1ci\u00f3s f\u00e1jl m\u00f3dos\u00edt\u00e1s\u00e1val: <a href=\"https:\/\/lp.skyboxsecurity.com\/rs\/440-MPQ-510\/images\/Skybox_customer_notification_CVE-2021-44228-Dec14-2021.pdf\">https:\/\/lp.skyboxsecurity.com\/rs\/440-MPQ-510\/images\/Skybox_customer_notification_CVE-2021-44228-Dec14-2021.pdf<\/a><br \/>\n<\/p>\n<h5>Acronis<\/h5>\n<p>Az Acronis folyamatosan vizsg\u00e1lja, hogy mely term\u00e9kei \u00e9rintettek a Log4j s\u00e9r\u00fcl\u00e9kenys\u00e9g kapcs\u00e1n, \u00e9s t\u00e1j\u00e9koztatja \u00fcgyfeleit a felfedez\u00e9seir\u0151l.<br \/>\n<br \/>Az Acronis Cyber Protect Cloudban az Elasticsearch modul tartalmazza a Log4j k\u00f6nyvt\u00e1rat, a t\u00e1voli k\u00f3dfuttat\u00e1s azonban nem lehets\u00e9ges ezen modulon bel\u00fcl a Java Security Manager haszn\u00e1lata miatt. Az Acronis tov\u00e1bb\u00e1 \u00faj t\u0171zfalszab\u00e1lyokat is l\u00e9trehozott a potenci\u00e1lisan \u00e9rintett szerverekr\u0151l \u00e9rkez\u0151 kimen\u0151 kapcsol\u00f3d\u00e1sok \u00e9s DNS-lek\u00e9rdez\u00e9sek blokkol\u00e1sa \u00e9rdek\u00e9ben.<br \/>\n<\/p>\n<h5>Ivanti<\/h5>\n<p>Az Ivanti biztons\u00e1gi csapata azonnal megkezdte a term\u00e9kei kivizsg\u00e1l\u00e1s\u00e1t. A MobileIron Cloud nem \u00e9rintett, viszont a s\u00e9r\u00fcl\u00e9kenys\u00e9g hat\u00e1ssal van az al\u00e1bbi MobileIron term\u00e9kekre:<br \/>\n<br \/>\u2022\tMobileIron Core<br \/>\n<br \/>\u2022\tMobileIron Sentry<br \/>\n<br \/>\u2022\tCore Connector<br \/>\n<br \/>\u2022\tReporting Database (RDB)=20<br \/>\n<br \/>Az <a href=\"https:\/\/forums.ivanti.com\/s\/article\/Security-Bulletin-CVE-2021-44228-Remote-code-injection-in-Log4j?language=en_US\">Ivanti weboldal\u00e1n<\/a> el\u00e9rhet\u0151k a probl\u00e9ma orvosl\u00e1s\u00e1t c\u00e9lz\u00f3 utas\u00edt\u00e1sok.<br \/>\n<\/p>\n<h5>Radware<\/h5>\n<p>A Radware megold\u00e1sai k\u00f6z\u00fcl a <a href=\"https:\/\/support.radware.com\/app\/answers\/answer_view\/a_id\/1029752\/~\/cve-2021-44228%2C-a-critical-log4j-vulnerability\">KWAF, az Alteon Cloud Control (csak online m\u00f3dban), a Bot Manager Backend \/ Data API Endpoint \/ Virtual Appliance, valamint a Vision 4.83-as \u00e9s kor\u00e1bbi verzi\u00f3k vannak vesz\u00e9lyben<\/a>. Ezekhez a Radware a bejelentkez\u00e9shez k\u00f6t\u00f6tt <a href=\"https:\/\/portals.radware.com\/getdoc\/240e7e6e-ba99-45ea-9317-2b71394e1b21\/2021-44228.aspx\/\">Product Status<\/a> oldalon k\u00edn\u00e1l megold\u00e1si lehet\u0151s\u00e9geket.<br \/>\n<br \/>Az AppWall \u00e9s a Cloud WAF Service ugyanakkor m\u00e1r az els\u0151 nap \u00f3ta \u00e9szleli \u00e9s blokkolja a Log4Shell aktivit\u00e1st. December 9-e \u00e9s 12-e k\u00f6z\u00f6tt a Radware megold\u00e1sai t\u00f6bb ezer t\u00e1mad\u00e1si k\u00eds\u00e9rletet \u00e9szleltek.<br \/>\n<\/p>\n<h5>Stormshield<\/h5>\n<p>A Stormshield azonnal kifejlesztette term\u00e9keire vonatkoz\u00f3an a v\u00e9delmet. Ennek r\u00e9szletei a <a href=\"https:\/\/www.stormshield.com\/news\/log4shell-security-alert-stormshield-product-response\/\">Stormshield weboldal\u00e1n<\/a> olvashat\u00f3k. A c\u00e9g term\u00e9kportf\u00f3li\u00f3j\u00e1nak \u00e9rintetts\u00e9ge az al\u00e1bbi t\u00e1bl\u00e1zatban van \u00f6sszefoglalva:<br \/>justify<br \/>no-repeat;left top;;<br \/>auto<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/relnet.hu\/wp-content\/uploads\/2021\/12\/Stromshield_Log4Shell-min.jpg\" alt=\"Stromshield_Log4Shell-min\" \/><br \/>center<br \/>rn-kep-kepala<\/p>\n<h5>NNT<\/h5>\n<p>Az NNT hivatalos k\u00f6zlem\u00e9nye szerint a gy\u00e1rt\u00f3 egyik megold\u00e1sa sem haszn\u00e1lja az Apache Log4j k\u00f6nyvt\u00e1rat, \u00edgy a legfontosabb term\u00e9k\u00e9t, a Change Tracker Gen7 R2-t sem.<br \/>\n<br \/>A RelNet rendszerm\u00e9rn\u00f6kei az \u00fcgy kapcs\u00e1n folyamatos kapcsolatot tartanak fenn az \u00e9rintett gy\u00e1rt\u00f3kkal. Az \u00faj fejlem\u00e9nyekr\u0151l folyamatosan \u00e9rtes\u00edtj\u00fck partnereinket a <a href=\"https:\/\/relnet.hu\">https:\/\/relnet.hu<\/a> weboldalon.<br \/>\n<\/p>\n<h5>Forr\u00e1s<\/h5>\n<p><a href=\"https:\/\/nki.gov.hu\/figyelmeztetesek\/riasztas\/riasztas-apache-log4j-konyvtart-erinto-kritikus-serulekenyseggel-kapcsolatban\/\">Riaszt\u00e1s Apache Log4j k\u00f6nyvt\u00e1rt \u00e9rint\u0151 kritikus s\u00e9r\u00fcl\u00e9kenys\u00e9ggel kapcsolatban<\/a><br \/>justify<br \/>no-repeat;left top;;<br \/>auto<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Folyamatosan \u00e9rkeznek a RelNethez az \u00e1ltala k\u00e9pviselt gy\u00e1rt\u00f3k aj\u00e1nl\u00e1sai a Log4Shell s\u00e9r\u00fcl\u00e9kenys\u00e9ggel kapcsolatban. Ezeket vessz\u00fck most sorra, \u00e9s cikk\u00fcnket folyamatosan friss\u00edtj\u00fck.<\/p>\n","protected":false},"author":1086,"featured_media":19413,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[588,343,164,336,73,590],"tags":[519,2649,2650,2647,67,71,2646,2645,2605,113,1642,76,2651,1732],"yst_prominent_words":[],"class_list":["post-19473","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-acronis","category-ivanti","category-juniper-networks","category-pulse-secure","category-skybox-security","category-stormshield","tag-acronis","tag-apache","tag-cve-2021-44228","tag-gyartok","tag-ivanti","tag-juniper-networks","tag-log4j","tag-log4shell","tag-nnt","tag-pulse-secure","tag-radware","tag-serulekenyseg","tag-threat","tag-vulnerability-life-cycle"],"_links":{"self":[{"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/posts\/19473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/users\/1086"}],"replies":[{"embeddable":true,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/comments?post=19473"}],"version-history":[{"count":6,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/posts\/19473\/revisions"}],"predecessor-version":[{"id":19541,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/posts\/19473\/revisions\/19541"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/media\/19413"}],"wp:attachment":[{"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/media?parent=19473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/categories?post=19473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/tags?post=19473"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/relnet.hu\/en\/wp-json\/wp\/v2\/yst_prominent_words?post=19473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}