liblzma is vulnerable!

[chucky91]

Recent news that discovering that libs like liblzma are with binary that compromises ssh access, microsoft's vcpkg reversed!

Security Alert: Potential SSH Backdoor Via Liblzma

In breaking news that dropped just after our weekly security column went live, a backdoor has been discovered in the xz package, that could potentially compromise SSH logins on Linux systems. The m…

hackaday.com

 

[Codinablack]

Yes we all know, vcpkg has already fixed it, and that entire repo is currently under suspension from github because one of the maintainers is claiming he didn't know the other was doing such shady stuff, claims the versions signed by him were safe. There is ofc an investigation ongoing and such

 

[Fjorda]

If you want to temporarily fix your build:
Go to ports/liblzma/portfile.cmake and change line 3 to:

REPO bminor/xz

 

[highsanta]

Can you actually backdoor a server by sending malicious packets?

 

[Fjorda]

Can you actually backdoor a server by sending malicious packets?

What may not be clear is the connection to SSH. And it’s a trip. Many Linux distros patch sshd to add systemd features, and libsystemd pulls the liblzma library. That means the liblzma initialization code gets run when sshd starts. In the malicious code, the library checks argv[0], which is the name of the program being executed, for /usr/bin/sshd. Additionally it seems to check for debugging tools like rr and gdb. If the checks are green, liblzma replaces a few function calls with its own code. It’s a complicated dance, but the exploit is specifically looking to replace RSA_public_decrypt.

That’s a very interesting function to clobber, as it is one of the functions used to validate SSH keys. It’s not hard to imagine how malicious code here could check for a magic signature, and bypass the normal login process. The full analysis is still being done, and expect more information in the coming days.

But the bottom line is that a machine with a patched sshd binary, that also has xz packages version 5.6.0 or 5.6.1, is vulnerable to unauthenticated SSH logins.

 

[highsanta]

Ill risk it.

 

[Fjorda]

Ill risk it.

Exactly my thought lol

but seems like its only 5.6.0/5.6.1 versions of the xz packages, you should be good