4 ms·

First - JNDI is not logging library. I get that module can be named anything author wishes but it is too much after yesterdays "but why LDAP even in picture" co

by Woodi 5y ago

First - JNDI is not logging library. I get that module can be named anything author wishes but it is too much after yesterdays "but why LDAP even in picture" comments... :) JNDI is just: java Naming and Directory Interface: https://docs.oracle.com/javase/tutorial/figures/jndi/jndiarch.gif https://docs.oracle.com/javase/tutorial/figures/jndi/jndiarc... And all that log4fun is much more then one or two libraries bugs. Maybe even no or almoust no software bugs involwed ? List of "features" in play :> - log4j include realy rich log messages parser... - not proper usage of logs formats - log4j have ability to call to the network... - Internet calls are allowed from backend facing service like logger... - parsing "dot" have surprising effects - did't saw that in code, info after HN comments - log4j have ability to ask any database including LDAP for configuration - configuration have form of executable code :> .class WTF !!! - Java have ability to load .class files at runtime, analogous to linker .so/.dll files. Except Java can do this for files from network. Buitl-in feature, pretty automatic :> - security manager was off on JNDI, probably becouse naming services like directories for names and configurations are supoused to be internal and protected... - no one use Java sacurity manager, at least it's very serious and enterprise-only black magic (voices in the internet: no! it's not so hard to use ! just some certs!) - security manager is planned to be removed from Java anyway :) - security bugs from years ago didn't realy fixed... and last but no least: - Minecraft servers are being hacked all over the world ! Chaos and panic ! :) Something more ? :) Now, do loading executables from network is standard enterprisy practice ? Getting .dll's or COMs from db ? I hear once from Sun employee about SQL queries looked up from LDAP server. But it is Oracle now...

bradfitz 5y ago
On the name: I knew jndi wasn't accurate (I read the 2016 blackhat slides) but the name I was going to use for the joke, log4g, was already in use and I didn't want to screw with their search results.
- rendall 5y ago
  log4gol is the project name no one needs, but that we deserve, or something
rfoo 5y ago
> - parsing "dot" have surprising effects - did't saw that in code, info after HN comments This is fake. There are no "parsing dot have surprising effects" part in this bug. Actually there is no bug at all. All we have is a documented (though misleading) "hey you can call anything JNDI in your log message" INTENDED FEATURE.
nirui 5y ago
> - Minecraft servers are being hacked all over the world ! Chaos and panic ! :) It sounded funny, but last night I was laying on my bed watching my last video of the day uploaded by a Minecraft YouTuber (xisumavoid actually) who mentioned the "Critical Security Issue". Back then my first reaction was "HA! suck on that Mojang!" without a single awareness of how bad things actual turned out. I guess if you're a Java dev, subscribe to Minecraft news really helps (a little, maybe) LOL.
formerly_proven 5y ago
> - not proper usage of logs formats Multiple people said they were able to trigger the RCE by supplying the syntax in question in log parameters, so the CVE is independent of whether people let users provide a format string or not (log.info("foo: %s", var) vs. log.info(var)).

by Woodi 5y ago

bradfitz 5y ago

On the name: I knew jndi wasn't accurate (I read the 2016 blackhat slides) but the name I was going to use for the joke, log4g, was already in use and I didn't want to screw with their search results.

rendall 5y ago
log4gol is the project name no one needs, but that we deserve, or something

rfoo 5y ago

> - parsing "dot" have surprising effects - did't saw that in code, info after HN comments This is fake. There are no "parsing dot have surprising effects" part in this bug. Actually there is no bug at all. All we have is a documented (though misleading) "hey you can call anything JNDI in your log message" INTENDED FEATURE.

nirui 5y ago

> - Minecraft servers are being hacked all over the world ! Chaos and panic ! :) It sounded funny, but last night I was laying on my bed watching my last video of the day uploaded by a Minecraft YouTuber (xisumavoid actually) who mentioned the "Critical Security Issue". Back then my first reaction was "HA! suck on that Mojang!" without a single awareness of how bad things actual turned out. I guess if you're a Java dev, subscribe to Minecraft news really helps (a little, maybe) LOL.

formerly_proven 5y ago

> - not proper usage of logs formats Multiple people said they were able to trigger the RCE by supplying the syntax in question in log parameters, so the CVE is independent of whether people let users provide a format string or not (log.info("foo: %s", var) vs. log.info(var)).