Addigy and Apache’s Log4J2 CVE-2021-44228 Status

Nicolas Ponce | 12/12/2021

Addigy is aware of a recently disclosed security issue relating to the open-source Apache “Log4j2” utility (CVE-2021-44228). At the time of writing, Addigy does not use this library or has plans to use this library to provide its core services.

Additionally, Addigy leverages CloudFlare, which has released a new WAF rule to attempt to block Log4j exploit requests.

Our team is now working with our upstream vendors to confirm any usage with any third-party tools that may be impacted and will provide further updates on this page throughout the week.

For additional information, please visit our Addigy Trust Center. If you have additional questions, please contact [email protected]

Thank you for your continued partnership,

Addigy Security Team

 

December 13 2021 @ 1:00 PM US Eastern Update:

A great compiled list of vendor status is below:

https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592

Recommended reading for confirming vulnerability remediation:

https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/ 

Splashtop for RMM:

In response to your concern regarding the remote code execution vulnerability (CVE-2021-44228) related to Apache Log4j, in our investigation so far, we confirm that Splashtop is NOT vulnerable to this exploit, given the fact that the three main components of Splashtop servers do not use it to write logs.

To put the matter into perspective, here are the three main components:

Backend system – Java wasn’t used

API servers – Java wasn’t used

Relay servers – this module wasn’t used to write logs

As Splashtop and the industry at large continue to gain a deeper understanding of the impact of this threat, we will update the user with further information as they become available.

Splashtop thank you for your patience and continued support.

Regards,

Splashtop Business Support Team

Monitoring and Alerting Java on macOS Devices:

Addigy has default facts that can help you identify devices Java Version and Java Vendor:

You can find these facts in the Devices page as `Java Vendor` and `Java Version`:

You can build monitoring items to detect if Java is installed and alert you to take action:

Related Posts

WWDC – The most wonderful time of the year? Every June, we turn towards Cupertino and prepare for all the new things Apple will introduce. Speculation runs high on what new hardware will appear, what will the new macOS be […]
Here’s our monthly wrap-up of articles you don’t want to miss!   Using Parallels Desktop to Simplify macOS Testing – Parallels Blog If you’re a developer or IT admin, testing new software can be a time-consuming and tedious process. But […]
What Apple's Discontinuation of Fleetsmith Means for Companies
The clock is ticking for MSPs and IT teams that use Apple’s Fleetsmith Mobile Device Management (MDM). Apple announced early this year that it will discontinue the service in October, which means companies that rely on it will need to […]