Security News > 2022 > January > Microsoft: Attackers Tried to Login to SolarWinds Serv-U Via Log4j Bug

Threat actors have weaponized a newly discovered bug in SolarWinds Serv-U file-sharing software to launch Log4j attacks against networks' internal devices, Microsoft warned on Wednesday.

SolarWinds fixed the vulnerability in Serv-U version 15.3, released on Tuesday.

"The Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized," SolarWinds said in its advisory, adding that it had updated the input mechanism "To perform additional validation and sanitization."

For its part, MSTIC didn't give details about the attacks it's tracked that have been propagated via the Serv-U bug.

The Serv-U attacks are just the latest in the rampant Log4j exploit attempts and testing that have been thrown at the multiple flaws in Apache's Log4j logging library since those flaws were disclosed - and came under near-immediate attack - last month.

MSTIC strongly recommended that affected customers apply the SolarWinds security updates.

News URL

https://threatpost.com/microsoft-log4j-attackssolarwinds-serv-u-bug/177824/