The Issue:
On Dec. 9, 2021, a remote code execution (RCE) vulnerability in Apache log4j 2 was identified as being exploited in the wild. Log4j vulnerability, a bombshell zero-day exploit with global impact. Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform.
Act! Statement
It was recently announced by the Apache Foundation that Log4j, a popular Java logging library, is vulnerable to remote code execution. Immediately following the announcement of this serious vulnerability, our engineering and security teams evaluated all of our products, integrations and internal services for any potential impact. We have not detected any exploit attempts on our systems or solutions. We have completed an audit of our systems and do not believe this exploit represents a threat to our customers.
It should be noted that the "j" in Log4j stands for "Java", and Act! itself does not use java components (not Javascript which we do use for act! web client as well as c#/.net), so it's unlikely we are affected. Of course, we will continue to monitor our environment and notify our customers and partners as we learn more.
Keystroke Statement
Since the vulnerability was first discovered on December 9th, we consulted with all our current developers to determine if the open-source library files involved in the Log4Shell vulnerability were used in past or present projects. After a thorough review, we have determined that none of the add-ons produced in the last 4-years use either Java components or the Log4j opensource logging software.
Additionally, our review of the code for Handheld Contact service focussed on the device software, the Windows Console, and the hosted mware services used to process Classic syncing. This review concluded that the open-source logging files were never used in either the mobile device applications and Windows, and that the log4j library files previously used with mware were replaced with java.util.Logging (the java built-in logging framework) over four years ago.
At present we've concluded that none of the products or services we currently offer should be affected, but we provide further security statements as developments warrant.
