[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN_LGv0CU6J+5d6RX=mDrMvAg4kf3EGi+56x+J4iW0NCFRee1g@mail.gmail.com>
Date: Sat, 30 Mar 2024 02:59:14 +0800
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
On Sat, Mar 30, 2024 at 12:09 AM Andres Freund <andres@...razel.de> wrote:
> == Affected Systems ==
>
> The attached de-obfuscated script is invoked first after configure, where it
> decides whether to modify the build process to inject the code.
>
> These conditions include...
<snip>
> Running as part of a debian or RPM package build:
> if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = "xx86_64";then
Could you please confirm that the Arch Linux binary package was never
actually compromised?
> openssh does not directly use liblzma. However debian and several other
> distributions patch openssh to support systemd notification, and libsystemd
> does depend on lzma.
<snip>
> Observed requirements for the exploit:
> b) argv[0] needs to be /usr/sbin/sshd
I have checked, and found that Arch Linux does not apply any patches
when building OpenSSH.
P.S. in the detect.sh script, the "set -eu" line plays a bad trick: it
aborts the check if sshd is not actually linked to liblzma.
--
Alexander E. Patrakov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
