Summary: "The upstream xz repository and the xz tarballs have been backdoored."
It is known to be in version 5.6.0 and 5.6.1, and the obfuscated code is found in the test directory.
Backdoor in upstream xz/liblzma leading to SSH server compromise
11–20 of 1001 posts
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#12This potentially could be a full automated rootkit type breach right? Great - is any system with 5.6.1 possibly vulnerable?
Also super weird a contributor thought they could slip this in and not have it be noticed at some point. It may point to burning that person (aka, they go to jail) for whatever they achieved with this. (And whoever they are…)
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#13Homebrew is currently shipping 5.6.1 (and was shipping 5.6.0 as well). Hopefully not affected on mac?
The issue is caused by patches to add integration with systemd, so no, this won't affect SSH on a Mac.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#14NixOS/Pkgs 23.11 unaffected, unstable contains backdoored implementations (5.6.0, 5.6.1) but their OpenSSH sshd does not seem to link against systemd/liblzma, and the backdoor doesn't get configured in (only happens on .deb/.rpm systems).
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#15Very strange behavior from the upstream developers. Possible government involvement? I have a feeling LANG is checked to target servers from particular countries
[deleted]
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#16Safety through obscurity and weirdness! If you disable ifunc, like any sensible person, this backdoor disables itself.
I'm curious now. What is ifunc? (Had difficulty finding it through a search)
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#17That's completely crazy, the backdoor is introduced through a very cryptic addition to the configure script. Just looking at the diff, it doesn't look malicious at all, it looks like build script gibberish.
Yeah, now imagine they succeeded and it didn't cause any performance issues...
Can we even be sure no such successful attempt has already been made?
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#18That's completely crazy, the backdoor is introduced through a very cryptic addition to the configure script. Just looking at the diff, it doesn't look malicious at all, it looks like build script gibberish.
Thanks to autoconf, we're now used to build scripts looking like gibberish. A perfect place to hide a backdoor.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#19> Red Hat assigned this issue CVE-2024-3094.
Does that mean this affects RHEL and Fedora?
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#20So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet it takes a developer debugging performance issues to find an actual compromise.
I worked in the software supply chain field and cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong.