Support Bulletins

APACHE LOG4J VULNERABILITY (CVE-2021-45046) STATEMENT

December 17, 2021

VeEX’s products (test equipment) and cloud services are not affected by the Log4j 2 vulnerabilities. Nonetheless, since Log4j connections seem to run deep, our R&D and IT teams continue to audit our internal systems and monitor the situation. Network security is a top priority for us.

• NO Actions Required on our customers/users side

FYI: Log4j is a free open source logging framework for Java, created by the nonprofit Apache Software Foundation. It is widely used by software developers to record user activity and the behavior of applications for subsequent review. A critical Log4j flaw recently-disclosed has cybersecurity experts rising alarms. It allows attackers to execute code remotely on a target computer, allowing them to steal data, install malware or take control. For more information, visit NIST's National Vulnerability Database.

If you have any technical questions about security or vulnerabilities, specific to VeEX products and services, please contact our Support Team.

2019 GPS WEEK NUMBER ROLLOVER (WNRO) COMPATIBILITY STATEMENT

March 11, 2019

The industry is now worrying about another date rollover problem (similar to Y2K) that could potentially create significant issues in certain time-oriented systems, as they may not be able to calculate time stamps correctly, but that should not affect location (navigation) or timing applications. A GPS Week Number Rollover will occur at the end of the GPS day on April 6 2019, at which time the GPS week will transition from week 1023 to 1024 of the second GPS epoch. However, because the GPS message structure broadcasted by the satellites uses a 10-bit value to report the week number, the GPS messages will indicate that the week has changed from 1023 to week 0, potentially sending the date calculation back to August 1999, unless the receiver manufacturer has included extra calculations to carry over.

UX400 BROWSER-BASED REMOTE & JAVA COMPATIBILITY

August 28, 2015

The popular Java plug-in is considered insecure by many industry experts, to the point that it is no longer supported by newer browsers. On top of that, Oracle® has been busy releasing multiple Java™ updates (2014 - 2015). In the process they abolished the Medium security level setting and instead created a new Super Secured level, in which Java may not trust its own applications or even let users decide whether to take the risk of running them or not. These changes affected earlier versions of UX400 browser-based remote GUI features. VeEX is also moving away from Java plug-in to improve security and browser compatibility. This bulletin describes how to solve the browser compatibility and security blocking problems.

BASH/SHELLSHOCK EXPLOIT VULNERABILITY UPDATE

November 05, 2014

Some products sold and/or supported by VeEX may be affected by the Bash/Shellshock vulnerability. This bulletin lists the status of related products, available fixes and recommendations. It is recommended to keep all products updated to the latest OS versions available.