Security News > 2022 > January > Microsoft: SolarWinds fixes Serv-U bug exploited for Log4j attacks
SolarWinds has patched a Serv-U vulnerability discovered by Microsoft that threat actors actively used to propagate Log4j attacks to internal devices on a network.
Microsoft says they discovered the vulnerability during their monitoring of the Log4j attacks.
The bug is an input validation vulnerability discovered by Microsoft security researcher Jonathan Bar Or that allows an attacker to create a query and send it unsanitized over the network.
"During our sustained monitoring of threats taking advantage of the Log4j 2 vulnerabilities, we observed activity related to attacks being propagated via a previously undisclosed vulnerability in the SolarWinds Serv-U software," Microsoft explains in an update to their Log4J advisory.
At this point, it is unclear if the threat actors attempted to use the vulnerability but failed or if Log4j attacks were successfully propagated as indicated by Microsoft.
Threat actors have previously abused Serv-U vulnerabilities to perform Conti ransomware attacks and other undisclosed attacks.
News URL
Related news
- Microsoft Exchange targeted for IcedID reply-chain hijacking attacks (source)
- VMware Horizon platform pummeled by Log4j-fueled attacks (source)
- Microsoft detects Spring4Shell attacks across its cloud services (source)
- Microsoft takes down APT28 domains used in attacks against Ukraine (source)
- Microsoft dogs Strontium domains to stop attacks on Ukraine (source)
- Microsoft's huge Patch Tuesday includes fix for bug under attack (source)
- Microsoft releases fixes for Azure flaw allowing RCE attacks (source)
- Microsoft patches Windows LSA spoofing zero-day under active attack (CVE-2022-26925) (source)
- Microsoft closes Windows LSA hole under active attack (source)
- Microsoft fixes new PetitPotam Windows NTLM Relay attack vector (source)