Log in
Register
Cyber Forum
More options
Toggle width
Share this page
Share this page
Share
Share
Cyber Forum
Log in
Register
More options
Toggle width
Share this page
Share this page
Share
Share
Menu
Install the app
Install
Home
CyberWeekly Podcast
Breaking News! Podcast
Cyber Risk Rating
Forums
New posts
Forum list
Trending
Leaderboards
News Feeds
Resources
Latest reviews
Sophos X-Ops Intelix
Threat Reports
Members
Current visitors
My.CompTIA
Help Documents
Preference Center
Forums
Security
Active Exploits Discussion/Recommendations
Log4j Vulnerability Information
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Reply to thread
Message
<blockquote data-quote="Raffi Jamgotchian" data-source="post: 2438" data-attributes="member: 13"><p>Clearly an SBOM would be useful to understand what systems you have that could be affected by a flaw in a library such as this. I wonder how many software vendors are willing to publicly acknowledge what is being used and do they even know what their developers are pulling in? </p><p></p><p>Huntress made a blog post on this flaw that also includes a way to test if a system has this flaw by passing a POC string that would go through the library on its way to whatever logging mechanism has this issue:</p><p>[URL unfurl="true"]https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java[/URL]</p><p></p><p>Tom Lawrence also put together a good "lay-IT" description of the flow.</p><p>[MEDIA=youtube]CvkUPvIMM7o[/MEDIA]</p></blockquote><p></p>
[QUOTE="Raffi Jamgotchian, post: 2438, member: 13"] Clearly an SBOM would be useful to understand what systems you have that could be affected by a flaw in a library such as this. I wonder how many software vendors are willing to publicly acknowledge what is being used and do they even know what their developers are pulling in? Huntress made a blog post on this flaw that also includes a way to test if a system has this flaw by passing a POC string that would go through the library on its way to whatever logging mechanism has this issue: [URL unfurl="true"]https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java[/URL] Tom Lawrence also put together a good "lay-IT" description of the flow. [MEDIA=youtube]CvkUPvIMM7o[/MEDIA] [/QUOTE]
Name
Verification
Post reply
Forums
Security
Active Exploits Discussion/Recommendations
Log4j Vulnerability Information
Top
Bottom
Home
Forums
Threat Reports
My.CompTIA
Menu