[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <fc8936e9-4e95-4aef-ac30-f2d99817f3f7@nil.im>
Date: Sat, 30 Mar 2024 17:17:38 +0100
From: Jonathan Schleifer <js@....im>
To: "Rein Fernhout (Levitating)" <me@...itati.ng>,
oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
Am 30.03.24 um 16:10 schrieb Rein Fernhout (Levitating):
> The script attached by Andres was from 5.6.0.
> I extracted the script from both versions and I can verify your diff.
> I attached the two versions I extracted.
>
> It definitely does look like the 5.6.1 version looks for 2 extra scripts
> to execute.
> I don't get any matches on the greps either though.
My main worry is that when I extracted it, I replaced the sed in here:
sed \"r\n\" $gl_am_configmake | eval $gl_path_map | $gl_localedir_prefix
-d 2>/dev/null
With a simple cat, as I could not make sed work. This worries me as it
means there is probably some other transformation that I'm missing that
would have made the sed work. Which means there's transformations I'm
missing and those could as well mutate some of the test files or
resulting payloads. So it could either change the grep itself, or create
files that match the grep.
Which means I'm not sure that actually no files match and it actually
executes nothing.
> I also want to look more into the object file.
I think it's time to coordinate things.
I created a chat room for this on Matrix, IRC and Discord -- all bridged
together so it's essentially one chat room. Those interested, please join:
Matrix: #xz-backdoor-reversing:nil.im
IRC: #xz-backdoor-reversing on irc.oftc.net
Discord: https://discord.gg/XqTshWbR5F
--
Jonathan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
