Hows your log4j patching going?

[ibanezfoo]

Bwaaaaahahahahahahha this is not fun. Cisco on top of it so thats nice. APC/Schneider? Hahaha what patch?

[Misterclick]

FML

[Misterclick]

[Robotron2k84]

[the_tunaman]

Total clusterflock fire drill here…

[Robotron2k84]

I take it back. We had two Samsung Tizen TVs that needed an update

[ibanezfoo]

I take it back. We had two Samsung Tizen TVs that needed an update

That’s just it. It’s random crap. Have to dig into everything that has a web interface and see if it’s Apache based or Tomcat or whatever. Stupid stuff like serial over IP devices, etc. We have a ton of TVs all over but we don’t connect them to any networks, but still we are going through them. The ASAs and Cisco phone stuff had to be updated. Still looking into the Meraki and Cradlepoint stuff.

In my old office I had a poster with the Java logo crossed out and a big ol “NO JAVA” on it. I Fn HATE Java. Always have. It’s garbage. Always has been.

[L4D]

Cisco provided a list of non-affected products. Certain ASA and meraki is on that list

[techbill]

Still in progress. We had a security appliance have an issue that the Vendor had to emergency patch. Now to do all the apps. Total Java based shop!

[Robotron2k84]

[Marauder2003]

I thought log4j was used to log activities? Why would my Sony TV (Android) be logging anything?

[Robotron2k84]

For app developers. In the .Net case, I can only assume it was included to adhere to the CLR spec for ability to log to files.

[ibanezfoo]

I thought log4j was used to log activities? Why would my Sony TV (Android) be logging anything?

Most things are logged all the time, for tech troubleshooting if nothing else. Thats why I never believe any of the VPN companies saying they don't keep logs. Yeah right, otherwise how else would they know how their system is performing. Theres always logs. You can dump the logs to null but still, logging is happening...

[lazyworm]

https://log4jmemes.com/

[ocabj]

I'm waiting for the indirect log4j exploits where people cause upstream systems that aren't even remotely related to the Java frameworks to generate events that flow downstream to some app or a logging server or SIEM that is still vulnerable and ends up processing the event to make the jdni callout for the payload.

Based on response to this CVE, I also anticipate this will have post-incident changes, specifically consideration for SSL decryption in organization or institutions that lean towards privacy and have been hesitant to go that route for security controls.