Received: from BN0PR16MB4461.namprd16.prod.outlook.com (2603:10b6:408:157::24) by BL0PR16MB2612.namprd16.prod.outlook.com with HTTPS; Tue, 14 Dec 2021 14:33:18 +0000 Received: from BN0PR16MB4397.namprd16.prod.outlook.com (2603:10b6:408:150::18) by BN0PR16MB4461.namprd16.prod.outlook.com (2603:10b6:408:157::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4778.16; Tue, 14 Dec 2021 14:33:17 +0000 Received: from BN0PR16MB4397.namprd16.prod.outlook.com ([fe80::9c45:eb84:fdd4:e8f]) by BN0PR16MB4397.namprd16.prod.outlook.com ([fe80::9c45:eb84:fdd4:e8f%8]) with mapi id 15.20.4778.018; Tue, 14 Dec 2021 14:33:16 +0000 From: Rickie George To: Microix Support Subject: Log4j vulnerability Information Thread-Topic: Log4j vulnerability Information Thread-Index: Adfw9eYcU0h4rdkiRu6BlS6rDqHitQ== Date: Tue, 14 Dec 2021 09:33:16 -0500 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 04 X-MS-Exchange-Organization-AuthSource: BN0PR16MB4397.namprd16.prod.outlook.com X-MS-Has-Attach: X-MS-Exchange-Organization-Network-Message-Id: fc67633b-96d3-4fa1-fdac-08d9bf0eab05 X-MS-Exchange-Organization-SCL: -1 X-MS-TNEF-Correlator: X-MS-Exchange-Organization-RecordReviewCfmType: 0 x-ms-publictraffictype: Email authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=microix.net; x-ms-office365-filtering-correlation-id: fc67633b-96d3-4fa1-fdac-08d9bf0eab05 x-ms-traffictypediagnostic: BN0PR16MB4461:EE_ x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKI;H:BN0PR16MB4397.namprd16.prod.outlook.com;PTR:;CAT:NONE;SFS:;DIR:INB; x-microsoft-antispam: BCL:0; x-ms-exchange-crosstenant-network-message-id: fc67633b-96d3-4fa1-fdac-08d9bf0eab05 x-ms-exchange-crosstenant-originalarrivaltime: 14 Dec 2021 14:33:16.7199 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 047ca1d7-5314-4422-8db2-9017a42a0ba4 x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: EStJ+uUPlCrC6e6fB2bFeOxmjdYPWlyZGbvBVCY8qigHudJsyr5FIlYPn4KkutS2tsJleYEGbaJmXvfjjj3ILA== x-ms-exchange-transport-crosstenantheadersstamped: BN0PR16MB4461 x-ms-exchange-crosstenant-authsource: BN0PR16MB4397.namprd16.prod.outlook.com x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-transport-endtoendlatency: 00:00:02.2037217 x-ms-exchange-processed-by-bccfoldering: 15.20.4778.018 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506458)(944626604)(920097)(425001)(930097); X-Microsoft-Antispam-Message-Info: bCTsK9jJKj8Pa0ShwCiDZ/K1duTFdXkPYG1UE5zrkFJwq4CmFnjh99T7ZIe+m4CZXot3WLpY50ZikMy7z4Jj4A7h0SvYwoaANK/VgA3Jkbsup3AQJfe23/u3Ggaybj5o+6mOku1k0tFHisGqu15i7UsRl6MYqT2/Ks3oJyx7PZnuQkM3uAXoeISm8PHoz1egcMHgk+MYRCH+rbQec9DsrYXd2n47L6sxut2+wnZusMpaeR43XI6BKaA90HqFIT11fIQggRq1XvID6/ndKvIXhDWu1wZm8npVLEzH8AP4XLNrKf9sd381YjZnaAiFFMThhnQrhGJW8iwH1Vvkjqjbh1PsQGnIG9fd2UTagmwRDQwV94St9WkW3M9o91HyyXyQmCTLEF2mTWp1JNVO8RJ+Y4A/Sz/CoQvQUBoSW+IXrBVtDq5RRUJ3gEBWcU2945Ue9gnFc/iDUS8Um9P6gA38SrtQr2waXh4RCE2XNxOW1D5izMN7tYKVyg3xsuCUx5r6MH9VP992jHAvG2bkouIw1ciHpEbMFjTzXeslNNknpBzcnuBJWC6YgUk/Ofy18C3tNisc0UuYpcB7fETeo5FfGztCCEFaKOMyyztnG1Xzr6ETEpQt8vv2kHmMXrWZM2sRoph97vjbsHZfLjRv6wgXJ47zDwpI6YPCnenEY2kOh01A/JX6QeEUxt6mdwzixFTWUJEgXcPLVRMc5AiKdb5gRKa6rZ9kuAQy0aYielgD7QYoC7QbfhIo3/siCSnc2f7C Content-Type: text/html; charset="us-ascii" MIME-Version: 1.0

How are Microix products affected by the current vulnerability of Log4j?

Microix products (Workflow Modules Client, Web Companion, HTML Approval, Web Time) are currently not using the Log4j java libraries and our applications are not compatible to be hosted on Apache servers. Therefore our products should not be affected by the Log4j library vulnerability. Additionally, our internal software used by our team to communicate with customers were also confirmed to not be affected as well:

Simplehelp.com (Remote Connection Software)
Solar Winds (FTP and File Share)
Helpdesk (Jitbit)
DevExpress (UI Components)

Information about Log4j vulnerability…

A VULNERABILITY IN a widely used logging library has become a full-blown security meltdown, affecting digital systems across the internet. Hackers are already attempting to exploit it, but even as fixes emerge, researchers warn that the flaw could have serious repercussions worldwide.

The problem lies in Log4j, a ubiquitous, open source Apache logging framework that developers use to keep a record of activity within an application. Security responders are scrambling to patch the bug, which can be easily exploited to take control of vulnerable systems remotely. At the same time, hackers are actively scanning the internet for affected systems. Some have already developed tools that automatically attempt to exploit the bug, as well as worms that can spread independently from one vulnerable system to another under the right conditions.

Source…A Log4J Vulnerability Has Set the Internet 'On Fire' | WIRED