Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-07205

Опубликовано: 18 янв. 2022
Источник: fstec
CVSS3: 9.8
CVSS2: 10
EPSS Средний

Описание

Уязвимость адаптера JDBCAppender программы для журналирования Java-программ Log4j связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнять произвольные SQL-запросы к базе данных

Вендор

Oracle Corp.
Microsoft Corp.
NetApp Inc.
АО "НППКТ"
АО «НТЦ ИТ РОСА»
Apache Software Foundation
Brocade Inc.
QOS
АО «Концерн ВНИИНС»

Наименование ПО

Business Process Management Suite
WebLogic Server
Business Intelligence Enterprise Edition
Oracle JDeveloper
Oracle Communications Messaging Server
SQL Server
Enterprise Manager Base Platform
Oracle Communications Network Integrity
Oracle Retail Extract Transform and Load
Identity Manager Connector
Advanced Supply Chain Planning
SnapManager for Oracle
SnapManager for SAP
Communications Instant Messaging Server
Communications Unified Inventory Management
ОСОН ОСнова Оnyx
MySQL Enterprise Monitor
РОСА ХРОМ
Middleware Common Libraries and Tools
Log4j
Brocade SANnav
reload4j
Communications EAGLE FTP Table Base Retrieval
Oracle Communications Offline Mediation Controller
E-business Suite Information Discovery
Oracle Financial Services Revenue Management and Billing Analytics
Oracle Healthcare Foundation
Hyperion Data Relationship Management
Hyperion Infrastructure Technology
Identity Management Suite
Tuxedo
Oracle E-Business Suite Cloud Manager and Cloud Backup Module
ОС ОН «Стрелец»

Версия ПО

12.2.1.3.0 (Business Process Management Suite)
12.2.1.3.0 (WebLogic Server)
12.2.1.3.0 (Business Intelligence Enterprise Edition)
12.2.1.4.0 (Business Intelligence Enterprise Edition)
12.2.1.3.0 (Oracle JDeveloper)
8.1 (Oracle Communications Messaging Server)
2017 (SQL Server)
12.2.1.4.0 (WebLogic Server)
13.4.0.0 (Enterprise Manager Base Platform)
14.1.1.0.0 (WebLogic Server)
12.2.1.4.0 (Business Process Management Suite)
7.3.6 (Oracle Communications Network Integrity)
13.2.5 (Oracle Retail Extract Transform and Load)
11.1.1.5.0 (Identity Manager Connector)
12.1 (Advanced Supply Chain Planning)
12.2 (Advanced Supply Chain Planning)
- (SnapManager for Oracle)
- (SnapManager for SAP)
13.5.0.0 (Enterprise Manager Base Platform)
5.9.0.0.0 (Business Intelligence Enterprise Edition)
10.0.1.5.0 (Communications Instant Messaging Server)
7.4.1 (Communications Unified Inventory Management)
до 2.4.3 (ОСОН ОСнова Оnyx)
до 8.0.29 включительно (MySQL Enterprise Monitor)
12.4 (РОСА ХРОМ)
12.2.1.4.0 (Middleware Common Libraries and Tools)
от 1.2.0 до 1.2.17 включительно (Log4j)
- (Brocade SANnav)
до 1.2.18.2 (reload4j)
4.5 (Communications EAGLE FTP Table Base Retrieval)
до 12.0.0.4.4 (Oracle Communications Offline Mediation Controller)
12.0.0.5.0 (Oracle Communications Offline Mediation Controller)
7.4.2 (Communications Unified Inventory Management)
от 12.2.3 до 12.2.11 включительно (E-business Suite Information Discovery)
2.7.0.0 (Oracle Financial Services Revenue Management and Billing Analytics)
2.7.0.1 (Oracle Financial Services Revenue Management and Billing Analytics)
2.8.0.0 (Oracle Financial Services Revenue Management and Billing Analytics)
8.1 (Oracle Healthcare Foundation)
до 11.2.8.0 (Hyperion Data Relationship Management)
до 11.2.8.0 (Hyperion Infrastructure Technology)
12.2.1.3.0 (Identity Management Suite)
12.2.1.4.0 (Identity Management Suite)
12.2.2.0.0 (Tuxedo)
до 2.2.1.1.1 включительно (Oracle E-Business Suite Cloud Manager and Cloud Backup Module)
до 16.01.2023 (ОС ОН «Стрелец»)

Тип ПО

Прикладное ПО информационных систем
Сетевое программное средство
ПО виртуализации/ПО виртуального программно-аппаратного средства
СУБД
Операционная система
Сетевое средство

Операционные системы и аппаратные платформы

АО "НППКТ" ОСОН ОСнова Оnyx до 2.4.3
АО «НТЦ ИТ РОСА» РОСА ХРОМ 12.4
АО «Концерн ВНИИНС» ОС ОН «Стрелец» до 16.01.2023

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Критический уровень опасности (базовая оценка CVSS 3.0 составляет 9,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Apache Software Foundation:
https://security.netapp.com/advisory/ntap-20220217-0007/
Для программных продуктов Oracle Corp.:
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
Для программных продуктов NetApp:
https://security.netapp.com/advisory/ntap-20220217-0007/
Для ОС ОН «Стрелец»:
Обновление программного обеспечения apache-log4j1.2 до версии 1.2.17-7+deb9u2
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения apache-log4j1.2 до версии 1.2.17+repack-8+deb10u2.osnova1
Для операционной системы РОСА ХРОМ: https://abf.rosa.ru/advisories/ROSA-SA-2024-2519

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 94%
0.1499
Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 9.8
ubuntu
больше 3 лет назад

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS3: 8.8
redhat
больше 3 лет назад

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS3: 9.8
nvd
больше 3 лет назад

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS3: 9.8
debian
больше 3 лет назад

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as ...

CVSS3: 9.8
github
больше 3 лет назад

SQL Injection in Log4j 1.2.x

EPSS

Процентиль: 94%
0.1499
Средний

9.8 Critical

CVSS3

10 Critical

CVSS2