Tech

Patch fixing critical Log4J 0-day has its own vulnerability that’s under exploit

Posted on Author admin Comments Off on Patch fixing critical Log4J 0-day has its own vulnerability that’s under exploit
Patch fixing critical Log4J 0-day has its own vulnerability that’s under exploit

Enlarge (credit: Wikimedia Commons/Alex E. Proimos)

Last Thursday, the world learned of an in-the-wild exploitation of a critical code-execution zero-day in Log4J, a logging utility used by just about every cloud service and enterprise network on the planet. Open-source developers quickly released an update that patched the flaw and urged all users to install it immediately.

Now, researchers are reporting that there are at least two vulnerabilities in the patch, released as Log4J 2.15.0, and that attackers are actively exploiting one or both of them against real-world targets who have already applied the update. The researchers are urging organizations to install a new patch, released as version 2.16.0, as soon as possible to fix the vulnerability, which is tracked as CVE-2021-45046.

The earlier fix, researchers said on late Tuesday, “was incomplete in certain non-default configurations” and made it possible for attackers to perform denial-of-service attacks, which typically make it easy to take vulnerable services completely offline until victims reboot their servers or take other actions.

Read 6 remaining paragraphs | Comments

Related Articles
Tech

Extreme weather could be as expensive as investing in cutting carbon ASAP

Posted on Author admin

Enlarge (credit: Jason Persoff / Getty Images) Recently, a network of climate modeling groups showed that it will cost more to overshoot the Paris Agreement temperature goals than it will to stay on a low-temperature trajectory. On the same day, that collaboration also published work showing that additional risks of overshooting come in part via […]
Tech

{Audi and BMW to {} Formula E–here Is why that Is OK

Posted on Author admin

|} When Audi demonstrated its FE07 race car a week, it did not tell us it’d be the corporation’s last Formula E automobile. [credit: Audi ] Formula E likely expected that its preseason evaluation could be the source of several headlines today. Ahead of this electrical racing series’ seventh year launch in Chile in January, […]
Tech

Capcom States 350K people’s Information potentially leaked from ransomware Assault

Posted on Author admin

Expand Before this past year, Capcom disclosed there was”unauthorized entry completed by a third party” on its own internal computer programs, but the organization added that”today there’s not any sign that any client data was violated.” This afternoon, however, Capcom shown more information of their”customized ransomware assault” impacting its internal methods, possibly including the flow of […]