Found 6 bookmarks
Newest
XZ Utils Supply Chain Puzzle: Binarly Ships Free Scanner for CVE-2024-3094 Backdoor
XZ Utils Supply Chain Puzzle: Binarly Ships Free Scanner for CVE-2024-3094 Backdoor
On March 29, right before Easter weekend, we received notifications about something unusual happening with the open-source project XZ Utils, which provides lossless data compression on virtually all Unix-like operating systems, including Linux. The initial warning was sent to the Open Source Security mailing list sent by Andres Freund, who discovered that XZ Utils versions 5.6.0 and 5.6.1 are impacted by a backdoor. A few hours later, the US government’s CISA and OpenSSF warned about a critical problem: an installed XZ backdoored version could lead to unauthorized remote access.
#binarly#EN#2024#XZ#Supply-chain-attack#CVE-2024-3094#Scanner
·binarly.io·
XZ Utils Supply Chain Puzzle: Binarly Ships Free Scanner for CVE-2024-3094 Backdoor
xz-utils backdoor situation
xz-utils backdoor situation
This is still a new situation. There is a lot we don't know. We don't know if there are more possible exploit paths. We only know about this one path. Please update your systems regardless. Unknown unknowns are safer than known unknowns. This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't know much about what's going on.
#thesamesam#xz#CVE-2024-3094#backdoor#FAQ
·gist.github.com·
xz-utils backdoor situation
xz/liblzma: Bash-stage Obfuscation Explained - gynvael.coldwind//vx.log
xz/liblzma: Bash-stage Obfuscation Explained - gynvael.coldwind//vx.log
esterday Andres Freund emailed oss-security@ informing the community of the discovery of a backdoor in xz/liblzma, which affected OpenSSH server (huge respect for noticing and investigating this). Andres' email is an amazing summary of the whole drama, so I'll skip that. While admittedly most juicy and interesting part is the obfuscated binary with the backdoor, the part that caught my attention – and what this blogpost is about – is the initial part in bash and the simple-but-clever obfuscation methods used there. Note that this isn't a full description of what the bash stages do, but rather a write down of how each stage is obfuscated and extracted.
#gynvael#EN#xz#liblzma#analysis#CVE-2024-3094
·gynvael.coldwind.pl·
xz/liblzma: Bash-stage Obfuscation Explained - gynvael.coldwind//vx.log