Java Log4J vulnerability

[brotherblarneystone]

Is the Steam client effected by this vulnerability? If so, when will we expect a patch?

[=Snappy=]

Wondering also. Surprised it's not being discussed more.

[kelrizzo]

It's a pretty big deal. Due to the vulnerability on Minecraft servers, a malicious user could craft a message which would leverage the flaw on any players PC, providing the attacker control over that PC. I tend to think that the log4j2 library is not used on individual PCs, but it doesn't have to be in order to exploit a PC in the case of Minecraft. It's all going to depend on how Steam utilizes the library.

[Satoru]

.....

Steam client doesnt' use Java so....

No?

There's a reason why only the Java minecraft community is panicing

It would really only be an issue from a server perspective. But client side you basically aren't doing to be doing anything. I mean yes valve is probably patching apache now but its not a client side problem with steam

[cinedine]

It's not. The client is C++ or C# based as you can see by the countless DLL files it uses. While it's possible to use them in Java, it's also rather stupid doing it to that extend.
Java is not very common to be used for desktop applications but rather for web applications.

[kelrizzo]

Good info on the code base for the client.Yeah, like I said, no need to panic, but getting some info and making sure to look after your own personal security is never a bad thing! Also with the vulnerability residing on the Steam servers, it does pose questions regarding the security of the info (in many cases our personal info) that Valve is holding.

[cinedine]

Don't worry too much about it. There have been other exploits for years. Like Heartbleed in OpenSSL, which was far more commonly used.

Also: such news only go public AFTER the issue has been fixed. Look up "responsible disclosure". And they usually give enough time for users to update their ♥♥♥♥.

Edit: haha, posted right before the server issue.

[ponk]

You can go offline if you want to, but every news outlet that has talked about this has the same copypaste of "it affects steam, amazon, icloud" when Steam does not even use Java. Update your Minecraft if you've got it (this issue won't trouble you if you don't frequent public servers anyways) and you'll be fine.

[IFIYGD]

Cloudflare already updated and had all mitigation actions applied before noon today, EST. Steam sits behind Cloudflare.

Originally posted by cinedine:

<snip>
Java is not very common to be used for desktop applications but rather for web applications.

Cloud services use Apache Struts, quite commonly. So as to this:

Originally posted by Satoru:

.....

There's a reason why only the Java minecraft community is panicing...

Yeah, no, lol. There are a bunch of big enterprise apps and cloud service providers that have been kept hopping today. But like I said, Cloudflare has already announced they are updated and have all mitigations in place, and have tested for vulns extensively.

[cinedine]

Originally posted by IFIYGD:

Cloudflare already updated and had all mitigation actions applied before noon today, EST. Steam sits behind Cloudflare.

Originally posted by cinedine:

<snip>
Java is not very common to be used for desktop applications but rather for web applications.

Cloud services use Apache Struts, quite commonly. So as to this:

Originally posted by Satoru:

.....

There's a reason why only the Java minecraft community is panicing...

Yeah, no, lol. There are a bunch of big enterprise and cloud service providers that have been kept hopping today. But like I said, Cloudfalre has already announced they are updated and have all mitigations in place, and have tested for vulns extensively.

And Clownflare is ... serverside/backend. As are all cloud services. Nothing to do with the client.

[[N]ebsun]

Originally posted by cinedine:

Originally posted by IFIYGD:

Cloudflare already updated and had all mitigation actions applied before noon today, EST. Steam sits behind Cloudflare.


Cloud services use Apache Struts, quite commonly. So as to this:


Yeah, no, lol. There are a bunch of big enterprise and cloud service providers that have been kept hopping today. But like I said, Cloudfalre has already announced they are updated and have all mitigations in place, and have tested for vulns extensively.

And Clownflare is ... serverside/backend. As are all cloud services. Nothing to do with the client.

Someone gaining access (or worse, control) to backend servers is a pretty big deal, considering we all have information stored or passing through there by being users of Steam.

[Yasahi]

Originally posted by Lord Sir Dr. Santa Nebsun:

Someone gaining access (or worse, control) to backend servers is a pretty big deal, considering we all have information stored or passing through there by being users of Steam.

When talking about risks, one should always take into consideration how likely they are. If the chance is close to zero, there's really no point in panicking. This vulnerability for example can already be patched and prevented in a few different published ways. And it takes more than the existence of a vulnerability in some part of the system to actually exploit it.

[cinedine]

Originally posted by Lord Sir Dr. Santa Nebsun:

Originally posted by cinedine:

And Clownflare is ... serverside/backend. As are all cloud services. Nothing to do with the client.

Someone gaining access (or worse, control) to backend servers is a pretty big deal, considering we all have information stored or passing through there by being users of Steam.

Yes ... so?
Maybe I misunderstand why I was quoted by IFIYGD, but that still doesn't change the fact that the client isn't using Java, so there will be no patch for it as for the question. And that also doesn't change the fact that Java is not usually used for desktop applications but web applications.

The bug is a big deal. But there is nothing *you* can do about it. And worrying about Steam being affected is ... pretty much the least of your issues. Log4J is packaged in a LOT of frameworks and business solutions. Apache Solr for example is the most used search and recommendation engine for online stores and CMS and big data applications.
Log4J is one of the two most used logging frameworks in the Java world, so the impact cannot be underestimated (and it's certainly not only Minecraft users panicking about it).

But the bug IS fixed by the vendor, which is the reason we now know about it. It's now on the services to update their applications. And that's something you can be dead sure the big names are doing ASAP. I would rather worry about the smaller services you might use.
Community was down for a short time recently, so I assume Valve has already acted.

[Satoru]

Originally posted by cinedine:

Don't worry too much about it. There have been other exploits for years. Like Heartbleed in OpenSSL, which was far more commonly used.

Also: such news only go public AFTER the issue has been fixed. Look up "responsible disclosure". And they usually give enough time for users to update their ♥♥♥♥.

Edit: haha, posted right before the server issue.

To be fair its a zero day so there hasn't been a lot of time to remediate the issue. Its also mega actively being exploited so

[Satoru]

Originally posted by ponk:

You can go offline if you want to, but every news outlet that has talked about this has the same copypaste of "it affects steam, amazon, icloud" when Steam does not even use Java. Update your Minecraft if you've got it (this issue won't trouble you if you don't frequent public servers anyways) and you'll be fine.

Note the researchers did test that the steam servers themselves were potentially vulnerable. Note the 'server' part and not the client part. The servers are likely running Apache or at least some variant that uses the vulnerable software as its used pretty much in a lot of things. This is simlar to when the OpenSSH vulnerabilities started popping up. Its used in a lot of servers and thus its exploitation was a big problem. Log4J is used in a lot of SERVER side software that is based in Java, and especially in a lot of Apache products.

Note that if the Minecraft client itself wasn't vulnerable, or if Minecraft servers were still not using Java (java servers are much more popular because of their ability to mod despite MS desperately trying to get people to move off of Java) this likely wouldn't be causing as much panic amongst gamers. As I said above the OpenSSH issues were much much bigger problem but were of little concern to gamers. I had to do A LOT OF WORK because of it.

But that's an issue for Steam to deal with on their servers. This is being addressed also through edge providers that are actively blocking specific attacks as well

To be clear the client itself isn't' vulnerable and thus no 'patch' is coming for the client

Maybe possibly some server software may need to be updated though I'm not really sure if CS 1.6/TF2 servers use the vulnerable software. To be honest it would be much more likely that addons for said servers might be vulnerable to these attacks.

[Squingus]

Log4j

Is this security flaw patched out and do I need to be worried about it?