Ayrix not affected by critical Java vulnerability (log4j)

The Federal Office for Information Security has declared IT threat level 4 / Red for the vulnerability CVE-2021-44228 (“log4shell”) in the widely used Java software library log4j.

More information:

EN: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/log4j.html
DE: https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/log4j.html
FR: https://www.ncsc.admin.ch/ncsc/fr/home/aktuell/im-fokus/log4j.html

The security hole makes half the Internet unsafe. A zero-day exploit that exploits a vulnerability in the Java software Log4j makes numerous servers and apps vulnerable. Cybersecurity teams send alerts all around the world.

IMPORTANT NEWS:
✅ Ayrix and its products and services are not affected by this vulnerability and can continue to use Ayrix without any problems.

What’s happened

Many applications and online services written in the Java programming language are vulnerable due to a vulnerability that was unknown until recently. One of the best known affected services is the game “Minecraft”.

On December 9th, security researchers and various websites drew attention to a zero-day vulnerability in the Java logging library Log4j, writes inside-it.ch. The vulnerability, now numbered “CVE-2021-44228”, could lead attackers to run malware on affected computers. This is known as Remote Code Execution (RCE) and is considered to be one of the most potentially devastating ways to attack.

IT security authorities in various countries are warning that attacks have already taken place. Apparently information on the vulnerability and a corresponding attack tool (exploit) have been published on the Internet.

Who is concerned

Millions of applications and manufacturers which use log4j as protocol, including:

• Apple
• Twitter
• Steam
• Tesla
• Apache applications (Struts, Solr and Druid)
• Redis ElasticSearch
• Online games like “Minecraft”

What can be done

Depends on. Server administrators (admins) have been sweating since the incident and are trying to secure their systems. The first software updates (“patch”) have recently been available. Internet users should be particularly careful in the near future and must above all count on the providers to install the patch quickly.