skip to main content

Companies urged to check web servers for vulnerability

The vulnerability allows hackers to access and control web servers that are using the Java platform
The vulnerability allows hackers to access and control web servers that are using the Java platform

Organisations that use web servers are being urged by the National Cyber Security Centre to urgently assess them for a new vulnerability.

The issue, known as Apache Log4j, allows hackers to access and control web servers that are using the Java platform and potentially launch remote attacks.

The NCSC said it is likely malicious actors will shortly begin using this vulnerability to attack webservers.

As a result, organisations that are at risk are being warned they should rapidly take action to address the risk of their systems being compromised.

The vulnerability does not impact home or personal devices such as smartphones.

However, it is used by many web applications and cloud services, the NCSC said.

"There is no evidence of any successful exploitation of this vulnerability in the State, or any effect on services or data, but the risk of eventual compromise will persist for any entity until the vulnerability is addressed," the NCSC said.

"This vulnerability poses a serious risk to the security and integrity of data and the NCSC advises that organisations urgently assess their web servers for exposure to this risk," it stated.

"This should include services administrated and provided by third party service providers," it added.

A patch has been published by Apache and the NCSC said IT administrators will have to process them as soon as possible.

The vulnerability reportedly emerged late week among the users of a well-known online game.

But given the widespread use of the technology it is expected to be embedded in many other applications.

The form of open source java logging library that is potentially vulnerable is used by 30% of web servers, although not all of those servers are thought to be at risk.

Experts say the issue is among the highest tiers of vulnerability.

It is understood that critical infrastructure providers here have acted quickly to deal with the issue.