SecureAuth security advisory – Apache Log4j vulnerability

Updated: December 15, 2021

On December 9, 2021, information about a critical unauthenticated RCE vulnerability (CVE-2021-44228), that affects Java logging package log4j, was tweeted and a proof-of-concept (PoC) was posted on GitHub. This vulnerability could allow attackers full control of the affected server if a user-controlled string is logged. Since it is so easily exploited, the impact of this vulnerability is severe. The vulnerability is already being actively exploited in the wild.

While some SecureAuth products do utilize Apache Log4j in some components, the following products are not using the vulnerable class directly within them:

The one remaining module that is potentially affected is the SecureAuth RADIUS Server.  In some instances, it could be compromised with the proof-of-concept that was released.

Our Engineering department has resolved the issue with the latest version of the SecureAuth RADIUS Server, which you can download from the SecureAuth Product Downloads page.

For upgrade instructions, see Upgrade SecureAuth IdP RADIUS Server to v20.12.

In addition the RADIUS server upgrade, you might consider implementing firewall rules to restrict the RADIUS server to communicate only with known trusted destinations.  We also recommend sending the RADIUS logs to a centralized logging solution that can scan for the indicators of compromise.