{"id":10361,"date":"2021-12-13T16:41:49","date_gmt":"2021-12-13T13:41:49","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=10361"},"modified":"2021-12-13T16:41:49","modified_gmt":"2021-12-13T13:41:49","slug":"log4shell-critical-vulnerability-in-apache-log4j","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/10361\/","title":{"rendered":"Apache Log4j k\u00fct\u00fcphanesindeki kritik g\u00fcvenlik a\u00e7\u0131\u011f\u0131"},"content":{"rendered":"<p>\u00c7e\u015fitli haber kaynklar\u0131, Apache Log4j k\u00fct\u00fcphanesinde <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-44228\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2021-44228<\/a> no.lu (CVSS \u00f6nem d\u00fczeyi 10 \u00fczerinden 10 olan) kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ke\u015ffedildi\u011fini duyurdu. Milyonlarca Java uygulamas\u0131, hata mesajlar\u0131n\u0131 g\u00fcnl\u00fc\u011fe kaydetmek i\u00e7in bu k\u00fct\u00fcphaneyi kullan\u0131yor. Daha da k\u00f6t\u00fcs\u00fc, sald\u0131rganlar halihaz\u0131rda bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan aktif olarak yararlan\u0131yor. Bu nedenle Apache Foundation, t\u00fcm geli\u015ftiricilerin kulland\u0131klar\u0131 k\u00fct\u00fcphaneyi 2.15.0 s\u00fcr\u00fcm\u00fcne g\u00fcncellemelerini, e\u011fer bu m\u00fcmk\u00fcn de\u011filse <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\" target=\"_blank\" rel=\"noopener nofollow\">Apache Log4j G\u00fcvenlik A\u00e7\u0131klar\u0131 sayfas\u0131nda<\/a> belirtilen y\u00f6ntemlerden birini kullanmalar\u0131n\u0131 \u00f6neriyor.<\/p>\n<h2>CVE-2021-44228 neden bu kadar tehlikeli?<\/h2>\n<p>Log4Shell veya LogJam olarak da adland\u0131r\u0131lan CVE-2021-44228 g\u00fcvenlik a\u00e7\u0131\u011f\u0131,<a href=\"https:\/\/encyclopedia.kaspersky.com\/glossary\/remote-code-execution-rce\/\" target=\"_blank\" rel=\"noopener\"> Uzaktan Kod Y\u00fcr\u00fctme (Remote Code Execution \u2013 RCE)<\/a> s\u0131n\u0131f\u0131nda yer alan bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r. Sald\u0131rganlar herhangi bir sunucuda bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararland\u0131\u011f\u0131nda, iste\u011fe ba\u011fl\u0131 kod y\u00fcr\u00fctme ve potansiyel olarak sistemin t\u00fcm kontrol\u00fcn\u00fc ele ge\u00e7irme imkan\u0131na sahip olurlar.<\/p>\n<p>CVE-2021-44228\u2019i \u00f6zellikle tehlikeli yapan \u015fey, bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlanman\u0131n kolay olmas\u0131d\u0131r: Deneyimsiz bir hacker bile bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 kullanarak ba\u015far\u0131l\u0131 bir sald\u0131r\u0131 ger\u00e7ekle\u015ftirebilir. Ara\u015ft\u0131rmac\u0131lara g\u00f6re sald\u0131rganlar\u0131n uygulaman\u0131n g\u00fcnl\u00fc\u011fe tek bir dize (string) yazmaya zorlamas\u0131 yeterli, ard\u0131ndan <em>message lookup substitution<\/em> (mesaj arama de\u011fi\u015fim) fonksiyonu sayesinde kendi kodlar\u0131n\u0131 uygulamaya y\u00fckleyebiliyorlar.<\/p>\n<p>CVE-2021-44228 g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlanan sald\u0131r\u0131larla ilgili <a href=\"https:\/\/encyclopedia.kaspersky.com\/glossary\/poc-proof-of-concept\/\" target=\"_blank\" rel=\"noopener\">Kavram Kan\u0131tlar\u0131na (Proof of Concept \u2013 PoC)<\/a> internetten ula\u015f\u0131labiliyor. Bu nedenle, siber g\u00fcvenlik \u015firketlerinin g\u00fcvenlik a\u00e7\u0131\u011f\u0131na sahip uygulamalar\u0131 bulmak i\u00e7in ger\u00e7ekle\u015ftirilen b\u00fcy\u00fck \u00e7apl\u0131 a\u011f taramalar\u0131 ve bal k\u00fcplerine (honeypots) y\u00f6nelik sald\u0131r\u0131larla kar\u015f\u0131la\u015fmas\u0131 hi\u00e7 de \u015fa\u015f\u0131rt\u0131c\u0131 de\u011fil.<\/p>\n<p>G\u00fcvenlik a\u00e7\u0131\u011f\u0131, Alibaba Bulut G\u00fcvenlik Ekibinden Chen Zhaojun taraf\u0131ndan ke\u015ffedildi.<\/p>\n<h2>Apache Log4J nedir ve bu k\u00fct\u00fcphane neden bu kadar pop\u00fcler?<\/h2>\n<p>Apache Log4j, Apache G\u00fcnl\u00fckleme Projesinin (Logging Project) bir par\u00e7as\u0131d\u0131r. Genel olarak, hatalar\u0131 g\u00fcnl\u00fc\u011fe kaydetmenin en kolay yollar\u0131ndan biri bu k\u00fct\u00fcphanenin kullan\u0131lmas\u0131 oldu\u011fu i\u00e7in \u00e7o\u011fu Java geli\u015ftiricisi bu k\u00fct\u00fcphaneyi kullanmay\u0131 tercih ediyor.<\/p>\n<p>Amazon, Apple iCloud, Cisco, Cloudflare, ElasticSearch, Red Hat, Steam, Tesla, Twitter ve daha bir\u00e7o\u011fu da dahil olmak \u00fczere \u00e7ok say\u0131da b\u00fcy\u00fck yaz\u0131l\u0131m \u015firketi ve online servis Log4j k\u00fct\u00fcphanesini kullan\u0131yor. K\u00fct\u00fcphanenin bu kadar pop\u00fcler olmas\u0131 nedeniyle baz\u0131 bilgi g\u00fcvenli\u011fi ara\u015ft\u0131rmac\u0131lar\u0131, \u00f6n\u00fcm\u00fczdeki birka\u00e7 g\u00fcn i\u00e7inde savunmas\u0131z sunuculara y\u00f6nelik sald\u0131r\u0131larda \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131\u015f ya\u015fanmas\u0131n\u0131 bekliyor.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"qme\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Log4Shell?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Log4Shell<\/a> <a href=\"https:\/\/t.co\/1bKDwRQBqt\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/1bKDwRQBqt<\/a><\/p>\n<p>\u2014 Florian Roth (@cyb3rops) <a href=\"https:\/\/twitter.com\/cyb3rops\/status\/1469326219174891520?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">December 10, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2>Hangi Log4j k\u00fct\u00fcphanesi s\u00fcr\u00fcmleri g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan etkileniyor ve sunucunuzu sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l korursunuz?<\/h2>\n<p>2.0-beta9\u2019dan 2.14.1\u2019e kadar hemen hemen t\u00fcm Log4j s\u00fcr\u00fcmleri savunmas\u0131z durumda ve g\u00fcvenlik a\u00e7\u0131\u011f\u0131na kar\u015f\u0131 kullan\u0131labilecek &lt;<strong>en basit ve en etkili koruma y\u00f6ntemi, k\u00fct\u00fcphanenin en yeni s\u00fcr\u00fcm\u00fc olan 2.15.0\u2019\u0131 y\u00fcklemektir<\/strong>. Son s\u00fcr\u00fcm\u00fc <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\" target=\"_blank\" rel=\"noopener nofollow\">proje sayfas\u0131ndan<\/a> indirebilirsiniz.<\/p>\n<p>Herhangi bir nedenle k\u00fct\u00fcphaneyi g\u00fcncellemeniz m\u00fcmk\u00fcn de\u011filse, Apache Foundation, g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n etkilerinin azalt\u0131lmas\u0131na y\u00f6nelik a\u00e7\u0131klanan y\u00f6ntemlerden birinin kullan\u0131lmas\u0131n\u0131 \u00f6neriyor. Log4J\u2019nin 2.10\u2019dan 2.14.1\u2019e kadar olan s\u00fcr\u00fcmlerinden birinin kullan\u0131lmas\u0131 durumunda, <strong>log4j2.formatMsgNoLookps<\/strong> sistem \u00f6zelli\u011finin veya <strong>LOG4J_FORMAT_MSG_NO_LOOKUPS<\/strong> ortam de\u011fi\u015fkeninin <strong>true<\/strong> olarak ayarlanmas\u0131n\u0131 \u00f6neriyorlar.<\/p>\n<p>K\u00fct\u00fcphanenin geli\u015ftiricileri Log4j\u2019nin \u00f6nceki s\u00fcr\u00fcmlerine (2.0-beta9\u2019dan 2.10.0\u2019a kadar) ili\u015fkin koruma sa\u011flamak i\u00e7in ise, <strong>JndiLookup<\/strong>&lt; s\u0131n\u0131f\u0131n\u0131n \u015fu komut ile s\u0131n\u0131f yolundan kald\u0131r\u0131lmas\u0131n\u0131 \u00f6neriyor: <strong>zip -q -d log4j-core \u2013 *. Jar org \/ apache \/ logging \/ log4j \/ core \/ lookup \/ JndiLookup .class<\/strong>.<\/p>\n<p>Ek olarak, sunucular\u0131n\u0131za\u00a0<a href=\"https:\/\/www.kaspersky.com.tr\/small-to-medium-business-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder_______\" target=\"_blank\" rel=\"noopener\">g\u00fcvenlik \u00e7\u00f6z\u00fcmleri<\/a> y\u00fcklemenizi \u00f6neriyoruz \u2014 bunu yapmak \u00e7o\u011fu durumda k\u00f6t\u00fc ama\u00e7l\u0131 kodun \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131n\u0131 tespit etmenizi ve sald\u0131r\u0131n\u0131n geli\u015fimini durdurman\u0131z\u0131 sa\u011flar.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kesb-trial-leadgen\">\n","protected":false},"excerpt":{"rendered":"<p>Ara\u015ft\u0131rmac\u0131lar, Apache Log4j k\u00fct\u00fcphanesinde CVSS&#8217;de 10 \u00fczerinden 10 olarak de\u011ferlendirilen kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ke\u015ffettiler. \u0130\u015fte g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan korunman\u0131n yollar\u0131.<\/p>\n","protected":false},"author":700,"featured_media":10362,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194,1727,1351],"tags":[2517,2515,2514,790,2516,2518],"class_list":{"0":"post-10361","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"category-smb","10":"category-threats","11":"tag-0days","12":"tag-apache","13":"tag-cve-2021-44228","14":"tag-guvenlik-aciklari","15":"tag-log4j","16":"tag-sfirinci-gun"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/10361\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/23739\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/19239\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/9631\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/25936\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/23933\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/23571\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/26549\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/26156\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/32080\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/43124\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/18255\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/18633\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/log4shell-critical-vulnerability-in-apache-log4j\/15618\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/27849\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/27930\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/log4shell-critical-vulnerability-in-apache-log4j\/24681\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/30102\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/log4shell-critical-vulnerability-in-apache-log4j\/29893\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/guvenlik-aciklari\/","name":"g\u00fcvenlik a\u00e7\u0131klar\u0131"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/700"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=10361"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10361\/revisions"}],"predecessor-version":[{"id":10363,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10361\/revisions\/10363"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/10362"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=10361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=10361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=10361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}