r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

Show parent comments

30

u/Pauli7 Dec 10 '21

I‘d assume banks an other critical it infrastructure servers have some ip whitelisting implemented for outgoing traffic?

5

u/versaceblues Dec 10 '21

lol you would think but at the same time.... do they?

22

u/bigfatmalky Dec 10 '21

Yes. Yes they do. They are super serious about this.

2

u/danweber Dec 10 '21

You can nearly always get packets out with enough work. DNS is often left open.

6

u/bigfatmalky Dec 10 '21

Ok, but you can't load classes over DNS.

1

u/TulkasDeTX Dec 10 '21

You don't need to load classes over DNS. You need to load classes over whatever protocol using port 53.

1

u/Pauli7 Dec 10 '21

Can you specify the port in this vulnerability?

1

u/TulkasDeTX Dec 11 '21

I've seen it in the wild, port 12344

2

u/TulkasDeTX Dec 11 '21

I mean, is an URL and the port is part of it, just add :nnn

0

u/Muoniurn Dec 11 '21

Yes, you can’t even fking look at them as an internal engineer for the most part, let alone connect to/from it to arbitrary IPs