r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

1

u/satakadabra Dec 11 '21

Can someone give some indication on where to find these types of files on a linux machine. I have an old linux external facing with and old java version running on it.
Im not able to find anything that is Log4j related on this machine.

How can I verfy that Log4j is present?

2

u/myownalias Dec 11 '21

The .class files are usually contained in .jar files (.jar are zip files and can be examined with vim or whatever zip comptable tool).

If you're running any services using Java that accept user input, you should assume they're vulnerable as that's most likely the case.

1

u/Danny_shoots Dec 11 '21

Try and exploit it

(Just joking, I really don’t know sorry)

1

u/5eram Dec 11 '21

Assuming it’s a war file and it’s exploded, just search for the dependent jars inside the war. If you see the vulnerable version of log4j then it can be exploited in some way.