Second security flaw found in Log4Shell software — what this means for you

Second security flaw found in Log4Shell software — what this means for you lot

(Image credit: Pexels)

The Log4Shell flaw that has website administrators rushing to patch servers fifty-fifty every bit criminals ramp up attacks now has a sibling.

A 2nd flaw has been plant in the same logging utility, one that could crash websites, and the utility'southward developers have rushed out a patch that fixes both flaws.

The new flaw, catalogued equally CVE-2021-45046 but which doesn't have a catchy name, abuses the same functions as Log4Shell, otherwise known as CVE-2021-44228.

It lets attackers cause a denial of service — i.e., a crash — in Log4j, the aforementioned utility being exploited by Log4Shell. That in turn might crusade websites using Log4j to malfunction or crash.

The initial patch to stop Log4Shell, version 2.fifteen.0 of Log4j, doesn't finish this new attack. And then the Apache Software Foundation, which maintains Log4j, yesterday (Dec. 13) released Log4j version 2.sixteen.0, which disables one of the functions that make the 2 flaws possible and removes the other part.

Crashing Log4j likely won't pb to the same devastating effects as Log4Shell does. The before flaw lets attackers slip malicious code into or steal sensitive data from any web server that contains Log4j somewhere in its software.

This new flaw might knock a web server offline, which is annoying and tin can exist expensive if business transactions are halted, only most likely won't outcome in permanent damage.

What to do about Log4Shell

Hundreds of thousands, if not millions, of web servers are believed to exist impacted by Log4Shell, and all versions of the Java runtime environment are affected. The only permanent solution is to update Log4j.

The Netherlands' National Cyber Security Center has posted a list of enterprise software thought to be vulnerable to Log4Shell, which likewise includes software that has been found to be not vulnerable.

Among the well-known names on the list are Amazon, Broadcom, Cisco, Citrix, Dell, HPE, Huawei, IBM, McAfee, Microsoft, Netflix, Oracle, Cherry-red Chapeau, Siemens and Trend Micro.

Equally detailed in our earlier story, almost Windows PCs, Macs and mobile devices are not vulnerable to attacks using Log4Shell unless the devices are running the Coffee runtime surroundings. (Microsoft's December Patch Tuesday updates don't address it.)

Gamers running Minecraft Coffee Edition do of course run Coffee, and they got a patch for Minecraft last week. Yesterday, Bitdefender reported seeing 2 campaigns that were putting ransomware and remote-access-Trojans on Windows machines that do accept Java installed.

But again, neither Windows nor macOS ship with Coffee installed. Linux desktops are more vulnerable, as many of them do take it. Ubuntu has already released patches fixing Log4Shell, and other Linux distributions have probably also done so.

Nevertheless, considering of the sheer volume of financial and personal information held in web-facing servers, such as credit-card and banking information, e-mail messages, login credentials, photos and other personal details, the risk of information breaches, identity thefts, credit card thefts and business relationship hijackings has probably never been college.

Likewise, criminals may utilise Log4Shell to decadent websites to distribute malware or use them in phishing attacks to steal your personal information.

At present is a perfect time to start using one of the best password managers, to install some of the best antivirus software, to freeze your credit files and to cheque your credit reports.

Paul Wagenseil is a senior editor at Tom'south Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-booty driver, code monkey and video editor. He's been rooting around in the information-security infinite for more 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown upwardly in random Tv set news spots and fifty-fifty moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.