#OWNCLOUD LOG4J CODE#

Aryaka has all the resources, the skills and the talent to minimize our attack surface, and make sure that our ability to respond to emerging threats is at the maximum.

The test is really about what you have done to minimize the potential risk, and what you can do to mitigate it when it manifests. Our engineering and operations teams have worked side by side with our security analysts to investigate our own cloud and confirm that based on everything that we know, we are not vulnerable to this exploit.Įventually, no one is 100% secure. What about the Aryaka’s Cloud-First WAN and security platform? Was it exposed?

We have confirmed third-party SASE solutions we support are not impacted.

Aryaka CORE network is not impacted by this vulnerability.

MyAryaka, including internal components do not use log4j 2 version anywhere.

Aryaka Network Access Point (ANAP) do not have any JAVA components and are not vulnerable.

Since the disclosure, the security team here at Aryaka Networks have been working tirelessly to identify, pinpoint and mitigate any potential vulnerability or exposure that our customers and our internal systems may have to this threat.ĩth December 2021: The security community became aware of active exploitation attempts in the Apache Log4j software.ġ0th December 2021: Aryaka Networks identified the traffic signature associated with this exploit and started actively monitoring our customer base.ġ2th December 2021: Aryaka Networks has confirmed the following services and systems are not affected:

#OWNCLOUD LOG4J CODE#

More simply put, this exploit would allow attackers to execute malicious code on Java applications, and as such, it poses a significant risk due to the prevalence of Log4j across the globe.Īryaka Networks’ Security Team have been working diligently This could allow a remote attacker to execute code on a server running Apache if the system logs an attacker-controlled string value with the attacker’s JNDI LDAP server lookup. To provide some technical background, a flaw was found in the Java logging library “Apache Log4j 2” in versions from 2.0-beta9 to 2.14.1. With a CVSS (Common Vulnerability Scoring System) score of a perfect 10.0, CVE-2021-44228 has the highest and most critical alert level and has been nicknamed “Log4Shell”. On December 9th, 2021, the security industry became aware of a new vulnerability, CVE-2021-44228.

Owncloud log4j