News and Alerts
A new, never before seen exploit (zero-day) has been identified in the Apache software. Log4j, a component of many commercial java-based software applications, is a logging library maintained by the Apache Software Foundation. Current versions Log4J 2.0 beta 9 through 2.16.0 are susceptible to this exploit that could result in remote code execution. Cyber criminals can use this remote code execution to install malicious tools like crypto-mining , cobalt strike/ransomware agents, perform denial of service attacks or exfiltrate data. To fix this issue it is recommended that you update Log4j to version 2.15.0 to version 2.17 which will completely disable the vulnerable features of log4j. Please be sure to practice healthy patching methods to both scan and test all patches for systems prior to release in Production. The KSU Cyber Security Incident Response Team is here to assist and advise. Please send a list of all in scope applications and any steps you’ve taken to Security@kent.edu (Subject Line: “Log4J Concernsâ€). If you’ve experienced a compromise of any kind, please contact the KSU Information Security Team immediately.
Read more for more information regarding this issue, including steps to detect, remediate, and respond.