Log4j͑債ƂȂH@Ǝ㐫Ή̓Xvg}\H@SBOMʼnH\\piyokangoɕFWF1PVX̂߂̐Ǝ㐫Ǘ^̌i1j
܂̎ɑƎ㐫Ǘ^݂̍TWuLog4j 2ANEhݒ~XȂ\1PVX̂߂̐Ǝ㐫Ǘ^̌vB́ACVfg܂Ƃ߂ċL^upiyologv^cpiyokangoɁÃCVfgɁA܂ɂ_uƂǂׂvɂĕB
̋L͉łBo^ijƑSĂ܂B
@I[v\[X\tgEFAiOSSj̗pOɂȂAgƎ㐫h邱Ƃ͔ɏdvB̑Ή̑Ƃ̑E悤ɂȂĂBVXe̐ƎiႭjlƂA݂ł̓\tgEFA̐Ǝ㐫łȂAn[hEFAɋ߂̐Ǝ㐫AݒɋNO[][̐Ǝ㐫AđgD̐Ǝ㐫lĂ˂ȂȂB
@푽lȐƎ㐫ɑΉɂ́AJꂽɁAƂďVXeȂǂ̌̒S҂ǂɏœ_ĂBŁACVfg܂Ƃ߂ċL^upiyologv^cpiyokangoɁÃCVfgɁAɂ_uƂǂׂvɂĕB
Ǝ㐫͏IȂ
\\Ǝ㐫Ɋւ鎖XƖ炩ɂȂĂ܂Bŋ߁ApiyokangöۂɎcAIȐƎ㐫͂܂H
piyokango@ŋ߂̎Ƃ͂Ȃ܂A͂uApache Log4j 2viȉALog4jj̐Ǝ㐫iCVE-2021-44228jɊ֘AƎv܂B̐Ǝ㐫2021Nɑ傫ڂAerVȂǂ̃fBAłLグ܂B
@2021N12̌\ɂ́AƎ㐫p銈Ɋ֘Aϑ܂A̐Ǝ㐫Ɋ֘ACVfg͑܂łB̐̕s͂ɂA^ɑ_AC^[lbgɌJꂽVXeւ̑ΉvɍsꂽʂƎv܂B
@ł́AȂgŋ߁hƂĎグ̂ƂƁALog4jɊւƎ㐫̉éAȂĂ邩łBč̃TCo[ZLeBCtZLeBiCISAjLog4j̐Ǝ㐫Ɋ֘AAhoCU[2022N6A7ƑďoĂ܂BuЃAN^[ɂLog4jpVXeւ̃TCo[UˑRƂđĂ̂ŁAxvƒӊN̂łB
@vԂƁASANS Technology InstituteiȉASANSǰҁiJohannes UllrichjA2021N12Log4j̐Ǝ㐫^C~OŁAuLog4jւ̑Ή̓}\̂悤ɂȂB̂悤ɍl悤vƃRgƂLɎcĂ܂BLog4j̓CułAuVXe̒̂ǂŎgĂ邩v肷邱ƂdvłALog4jĂVXeRȂoKvꍇ͎ԂɗvĂ܂Ƃ܂B̈ӖŁg}\hƕ\̂܂B
@CISA̒ӊNƁALog4ĵ̂ł͂ȂA̐Ǝ㐫puVMware HorizonvuVMware Unified Access GatewayiUAGjvւ̍UɌxƂeɂȂĂ܂BƎ㐫̏Ĉ2022N1Ƀpb`J܂AKpłĂȂgDUɎĂ\̂łBCISÂ悤ȓeŒӊN2ɂ킽ďoƂƂ́A[ȔQɂȂ肩˂ȂĂ̂ł͂ȂƐł܂B
\\ΉiޑgDAΉxgDĂƂۂłB
piyokango@ΉxĂ܂gD́AƎ㐫ɊւāumȂvƂꍇAumĂāAD揇ʂႩvƂꍇł傤BɒmĂꍇłA܂ɍ̂悤ɐƎ㐫Ɋ֘AĂ܂ƂŁuUɂvƌAΏۂ̃VXeC^[lbgɂȂĂȂ肷邱ƂŁAupb`Kp̗Dx͉Ă悢vulƂƂIȑΉł悢vƔfĂ܂ꍇ̂ł͂Ȃł傤B
@ł́A̎iŎГVXe̋Eɓ荞݁Ǎ̃lbg[Nɑ݂Ǝ㐫_U킯łB
uXvg[Xvn܂u}\vɑ
\\ГVXȇΉxꍇł傤ˁB
֘AL
uZLeB̃AṽT[`[3lUԂAuNēOv͖{ɓOH
ITmedia Security Week 2022ĂDay2uւȂZLeBv][̊uŁAZLeBT[`[3lɂplfBXJbVû߂̒nł߂@͂ߘaȂ̂ŁvsꂽBC^[lbgCjVAeBu̍ݐjASBeNmW[̒ҐLOAupiyologv^cpiyokangoW܂AgZLeB̍ŐVhƂ͏XقȂxNgł̉bJLꂽB
ZLeB̃ghFȂLog4Shell̐ƎiႭj͍Uꑱ̂
2021N12AApache Log4j̐ƎiႭjłLog4Shell̏JꂽB{ełLog4Shell̊TvƁAȂU҂Log4Shellp̂B
mH@ӖH@Ǝ㐫˂ꂽƂZLeBpb`KpłȂR\\pb`}lWg͂ǂȌʂ̂
pb`Kp̎ԂZkuvɂĉAځB́AƎ㐫˂ꂽƂZLeBpb`KpłȂRAupb`KpƂƂ͉̂Ȃ̂v܂Bpb`KpŜǗƖupb`}lWgvƁA̎炷ʂɂĂ܂B
Copyright © ITmedia, Inc. All Rights Reserved.
ڂ̃e[}
ITmedia̓ACeBfBAЂ̓o^WłB