[ad_1]
SolarWinds has patched a Serv-U vulnerability found by Microsoft that risk actors actively used to propagate Log4j assaults to inside units on a community.
Microsoft says they found the vulnerability throughout their monitoring of the Log4j assaults.
The bug is an enter validation vulnerability found by Microsoft safety researcher Jonathan Bar Or that permits an attacker to create a question and ship it unsanitized over the community.
“Throughout our sustained monitoring of threats making the most of the Log4j 2 vulnerabilities, we noticed exercise associated to assaults being propagated through a beforehand undisclosed vulnerability within the SolarWinds Serv-U software program,” Microsoft explains in an replace to their Log4J advisory.
“We found that the vulnerability, now tracked as CVE-2021-35247, is an enter validation vulnerability that might permit attackers to construct a question given some enter and ship that question over the community with out sanitation.”
Yesterday, SolarWinds issued an advisory for CVE-2021-35247 and launched Serv-U 15.3 to repair the vulnerability.
“The Serv-U internet login display to LDAP authentication was permitting characters that weren’t sufficiently sanitized,” reads SolarWinds advisory.
“SolarWinds has up to date the enter mechanism to carry out further validation and sanitization.”
Nonetheless, SolarWinds states that no downstream impact has been detected “because the LDAP servers ignored improper characters,” contradicting Microsoft’s report.
At this level, it’s unclear if the risk actors tried to make use of the vulnerability however failed or if Log4j assaults had been efficiently propagated as indicated by Microsoft.
Menace actors have beforehand abused Serv-U vulnerabilities to carry out Conti ransomware assaults and different undisclosed assaults.
BleepingComputer has reached out to Microsoft and SolarWinds with additional questions however has not heard again right now.
[ad_2]
