What is the Infoblox Response to the log4j vulnerabilities?
On December 10th, a zero-day vulnerability (CVE-2021-44228) was discovered in a popular Java-based logging audit framework within Apache called Log4j. Since this disclosure, there has been a deluge of threat actors attempting to discover instances where this vulnerability still exists in order to exploit the issue. Infoblox has been diligently investigating this new threat, and we have concluded that our SaaS products are not subject to this vulnerability at this time. Investigative efforts are still ongoing for all Log4j-related vulnerabilities, including CVE-2017-5645, CVE-2019-17571, CVE-2020-9488, CVE-2021-4104 and CVE-2021-45046.
It is vital that an organization’s security infrastructure does not itself introduce any security vulnerabilities. Following an exhaustive audit of our solutions, we found that the most recent versions of NIOS 8.4, 8.5 and 8.6, BloxOneDDI, BloxOne Threat Defense, or any of our other SaaS offerings are not affected or do not pose an increased risk to the Log4j vulnerabilities listed above.
We are aware that a vulnerability exists in NetMRI. The specific attack vector has mitigations and dependencies, and the presence of this vulnerability does not increase the risk profile of the system.
To read more about this, check out this cyber campaign brief:
https://blogs.infoblox.com/cyber-thre...