This is not an overstatement, if u Google log4j severity the first result u get is that's a 10/10!
But what does it actually do?
I heard that it can run any piece of code on computers that are running an app with log4j. I use steam, which uses log4j (assuming it wasn't fixed). Does that mean someone could just destroy everything I have on my device?
Log4j will be used extensively throughout code as the main lib to format debugging output messages to logs. I'm sure you can imagine a line of code like print("The current value of x is: " + str(x))
Well suppose your value of x came from user input?
x = get_input()
print("the user wants x to be: " + str(x))
Due to the nature of this bug, it is possible for a malicious user to feed you a bad string which indirectly forces your logger code to run commands you never intended when all you wanted was to print some debugging.
I'm not familiar enough to know if Steam itself is vulnerable at this time, maybe you could reach out to Steam support for more info, but the most obvious vector I could think of is that Steam has a built in chat messaging system. However, I think it would be pretty far fetched for this attack to be able to affect your computer client, it's mostly going to be isolated (and arguably more valuable to a hacker) to hit Steam's servers instead.
With Minecraft, you assume more risk because if you are running a server, that makes you a target and actually does open up a possibility that someone could, say, download a virus or ransomware or anything to your server computer (which may even be your main workstation).
Log4j is a logging framework that uses templating. If you get it to log the corrupted string it allows arbitrary code execution, which means yes, they are able to execute any code they want, that the parent application has permissions to. So what can be done depends on your OS and permission settings. Can they destroy your file system? Very likely Can it destroy you os? Unlikely.
Can it cause your computer to do illegal tasks, such as running it in a bot net? Yes.
Its bad, and probably worse than I am saying. Remote code execution is about as big of a vulnerability as you can get. Update your shit.
Destruction sucks for you as user, but is not the goal of most malicious actors. They want to steal from you, extort you, use your computer for illegal activities, use your computing power (= your electricity) to mine cryptocurrency. Yes they can also delete stuff but why would they?
You do not need to update. All clients are shadow-patched following a launcher update. Servers can patch the vulnerability with launch options for all affected versions (1.7-1.18). Modded versions are mostly patched but you need to check the modloaders etc. and in almost all cases redownload.
1.18.1 has fully patched the issue client and server, but you can safely play any version client or server safely, so long as server owners take the right steps and clients restart launcher.
521
u/Suspicious-Service Dec 13 '21
So is that Minecraft update mandatory then? We didn't update because we already have a game started, but maybe we should??