Nicknamed Log4Shell, this major security flaw affects many servers, and it worries experts.
If you are using iCloud, Steam, or Minecraft, be careful. On Friday, cybersecurity experts shed light on a major software flaw endangering a large number of servers. Nicknamed Log4Shell, this flaw concerns the Log4j Java library, developed by the Apache foundation. Usually, the purpose of the latter is to record information about software, such as error reports.
Yes but there you go. Several researchers have discovered that it is possible to send web page links to this Log4j library. A consequent problem, since as long as the page in question contains lines of Java code, the latter could then be executed on the server.
A vulnerability called Log4Shell, which consists in executing computer code remotely on a machine according to the principle of remote code execution. Used for malicious purposes, the Log4Shell can have significant consequences, since it offers the possibility for a cybercriminal to enter directly on a server.
Significant repercussions
First discovered on November 24 by an expert from Chinese giant Alibaba, the flaw has since been quickly corrected, and a fix is still available on the Apache Foundation website. However, the problem is not yet fully resolved. The onus is now on server owners to enforce the update, in order to prevent potential attackers from exploiting the vulnerability.
Especially since we still do not know the scope of this Log4Shell flaw. The precise list of the servers concerned has not yet been published, but several countries, including France have already been sounded by the CERT (Computer emergency response team), its local study center responsible for monitoring threats and software flaws in real time. Among the largest companies affected at the moment, we can notably cite iCloud, Steam or even the Minecraft game. The game published by Mojang has already published an alert on its site, calling on all owners of its many servers to perform the latest security updates.
