Editorial · December 13, 2021
Log4j Vulnerability: What Small Firms Should Check
The Log4j vulnerability is a serious software flaw, and a small firm can check its exposure this week. Ask each software vendor in writing whether its product uses Log4j. Then ask which version it runs and whether the fix is installed. The flaw is tracked as CVE-2021-44228, and it has a top severity score of 10.0 out of 10.
You do not need to read code to do this. You need a list of your software and a few clear questions.
What the flaw is. Log4j is a free Java tool from the Apache Software Foundation. Programs use it to write log messages, which are records of what the software is doing. Apache says versions 2.0-beta9 through 2.14.1 do not properly guard a feature called JNDI. An attacker who can get text into a log message may be able to make the program load and run the attacker's code from another server. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says an attacker could take full control of an affected system. It also says attacks are already widespread.
Many products you buy may contain this tool without saying so. That is why asking your vendors matters.
Step 1: List what you run
Write down every program and online service your business depends on. Include web sites, online stores, booking tools, payroll, accounting, phone systems, security cameras and network devices. Mark the ones that face the internet. CISA tells organizations to start by listing external-facing systems that use Log4j, so those go at the top.
Next, note who supplies each item. Your own staff, an outside IT firm, or a vendor may each own part of the answer. Put a name next to each one.
Step 2: Ask vendors three plain questions
Send the same short message to each vendor and ask for a written reply.
- Does your product or service use Apache Log4j, including inside other software you bundle?
- If yes, which Log4j version is it, and is it 2.15.0 or newer?
- If not yet updated, what is the date, and what protection is in place until then?
Keep the replies. A vendor who says "we are checking" should give you a date for the next update. CISA says the people who maintain a product must install the Apache update before the flaw is fixed for users. You cannot fix a vendor's product yourself, so rely on their written answer and watch for their notices.
Step 3: Know which patch to confirm
Apache released Log4j 2.15.0 to address CVE-2021-44228. From that version on, the risky behavior is switched off by default. Ask vendors to confirm this version or a newer one. Apache also notes that Log4j 1.x is at end of life and gets no security fixes, so a product on 1.x should move to Log4j 2.
If a patch is not ready, Apache lists stopgaps. For releases 2.10 and later, set the system property log4j2.formatMsgNoLookups to true, or set the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true. For releases 2.0-beta9 through 2.7, the only stopgap is to remove the JndiLookup class from the program files. Your IT provider should be the one to do this work. These steps are temporary, and Apache still points users to the new version.
Step 4: Protect what you can now
While you wait on vendors, CISA advises three immediate actions. List the external-facing systems that use Log4j. Make sure the team or provider that watches your security alerts is acting on them. Put a web application firewall in front of internet-facing systems, with rules that update automatically. Ask your IT provider whether these are in place.
Patch in a sensible order. Start with systems that run the business and face the internet. Move to internal servers and other devices after that. Also watch for notices from your vendors, and install updates as soon as they arrive.
Step 5: Keep a record and a calendar
Make a simple table with one row per vendor. Add columns for the date you asked, the answer, the version, the patch date and who followed up. Check it again every few days, because answers will change as vendors finish their reviews. CISA says it will keep updating its guidance as it learns more, and it has added this flaw to its Known Exploited Vulnerabilities Catalog. Federal civilian agencies have until December 24, 2021 to fix it. Small firms have no such rule, but the date shows how urgent the government considers it.
If a vendor cannot or will not answer, treat that as a risk and ask whether you should switch tools or limit what they can reach. Tell your insurance broker, bank and key customers only what is true and confirmed.