runZero can help you build an up-to-date asset inventory and search for assets that may be affected by the spate of Log4J vulnerabilities (e.g. Log4shell, etc.). You can then share the results with your security team for investigation and mitigation. As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries. Self-hosted customers may copy the query, or use the Export System Queries option to download an importable query set from the cloud console.
It is worth noting that an updated version of the Java runtime is not a sufficient mitigation. Newer versions of Java block the URL class loader by default, but can still be abused to leak secrets from the environment, and deserialization attacks may still succeed using classes already loaded by the process.
Identifying every application, device, and service using the Log4J library is going to be an ongoing effort for security professionals. runZero can help.
See more info about how runZero can help with Log4J.
Learn how runZero helps build accurate asset inventories that cover zero-day incidents.
Get runZero for free: https://www.runzero/try/
Meet Our Speakers
Huxley Barbee
Contributor
Get the latest news and expert insights delivered in your inbox.
