* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Sunday, July 13, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Emily Deschanel was scolded during “Bones” season 1 for being ‘late and unprepared’: ‘I was just beside myself’ – Yahoo

    Emily Deschanel was scolded during “Bones” season 1 for being ‘late and unprepared’: ‘I was just beside myself’ – Yahoo

    How you can see new movies early – Yahoo

    Unlock the Secret to Watching New Movies Before Everyone Else!

    Immersive sports and entertainment venue Cosm set to build its 5th location in Cleveland – WKYC

    Cosm Reveals Exciting Vision for Its 5th Immersive Sports and Entertainment Venue in Cleveland

    Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

    Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

    Moses Singer Welcomes Entertainment and Intellectual Property Partner Frederick Bimbler – Yahoo Finance

    Moses Singer Expands Team with New Entertainment and Intellectual Property Partner Frederick Bimbler

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    China’s energy dominance in three charts – MIT Technology Review

    How China Is Powering Its Energy Dominance: A Visual Breakdown

    Meta Acquires AI Startup PlayAI to Enhance Voice Technology Capa – GuruFocus

    Meta Acquires AI Startup PlayAI to Revolutionize Voice Technology Capabilities

    Stallion Uranium Provides Update on Technology Data Acquisition Agreement – GlobeNewswire

    Stallion Uranium Announces Exciting Progress in Technology Data Acquisition Agreement

    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    SMPTE Opens Early Bird Registration for Media Technology Summit – TVTechnology

    SMPTE Launches Early Bird Registration for Exciting Media Technology Summit

    Google Fiber puts Nokia network slicing technology to the test – Fierce Network

    Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Emily Deschanel was scolded during “Bones” season 1 for being ‘late and unprepared’: ‘I was just beside myself’ – Yahoo

    Emily Deschanel was scolded during “Bones” season 1 for being ‘late and unprepared’: ‘I was just beside myself’ – Yahoo

    How you can see new movies early – Yahoo

    Unlock the Secret to Watching New Movies Before Everyone Else!

    Immersive sports and entertainment venue Cosm set to build its 5th location in Cleveland – WKYC

    Cosm Reveals Exciting Vision for Its 5th Immersive Sports and Entertainment Venue in Cleveland

    Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

    Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

    Moses Singer Welcomes Entertainment and Intellectual Property Partner Frederick Bimbler – Yahoo Finance

    Moses Singer Expands Team with New Entertainment and Intellectual Property Partner Frederick Bimbler

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    China’s energy dominance in three charts – MIT Technology Review

    How China Is Powering Its Energy Dominance: A Visual Breakdown

    Meta Acquires AI Startup PlayAI to Enhance Voice Technology Capa – GuruFocus

    Meta Acquires AI Startup PlayAI to Revolutionize Voice Technology Capabilities

    Stallion Uranium Provides Update on Technology Data Acquisition Agreement – GlobeNewswire

    Stallion Uranium Announces Exciting Progress in Technology Data Acquisition Agreement

    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    SMPTE Opens Early Bird Registration for Media Technology Summit – TVTechnology

    SMPTE Launches Early Bird Registration for Exciting Media Technology Summit

    Google Fiber puts Nokia network slicing technology to the test – Fierce Network

    Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

Malicious SSH backdoor sneaks into xz, Linux world’s data compression library

March 30, 2024
in Technology
Malicious SSH backdoor sneaks into xz, Linux world’s data compression library
Share on FacebookShare on Twitter

Red Hat on Friday warned that a malicious backdoor found in the widely used data compression software library xz may be present in instances of Fedora Linux 40 and in the Fedora Rawhide developer distribution.

The IT giant said the malicious code, which appears to provide remote backdoor access via OpenSSH and systemd at least, is present in xz 5.6.0 and 5.6.1. The vulnerability has been designated CVE-2024-3094. It is rated 10 out of 10 in CVSS severity.

Users of Fedora Linux 40 may have received 5.6.0, depending upon the timing of their system updates, according to Red Hat. And users of Fedora Rawhide, the current development version of what will become Fedora Linux 41, may have received 5.6.1. Fedora 40 and 41 have not been officially released yet; version 40 is due out next month.

Users of other Linux and OS distributions should check to see which version of the xz suite they have installed. The infected versions, 5.6.0 and 5.6.1, were released on February 24 and March 9, respectively, and may not been incorporated into too many people’s deployments.

This supply-chain compromise may have been caught early enough to prevent widespread exploitation, and it may only mainly affect bleeding-edge distros that picked up the latest xz versions right away.

Debian Unstable and Kali Linux have indicated they are, like Fedora, affected; all users should take action to identify and remove any backdoored builds of xz.

“PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or personal activity,” the IBM subsidiary’s advisory shouted from the rooftops today. “Fedora Rawhide will be reverted to xz-5.4.x shortly, and once that is done, Fedora Rawhide instances can safely be redeployed.”

Red Hat Enterprise Linux (RHEL) is not affected.

Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching

Open source software has its perks, but supply chain risks can’t be ignored

Sysadmins: Why not simply verify there’s no backdoor in every program you install, and thus avoid any cyber-drama?

CIOs largely believe their software supply chain is vulnerable

How ‘sleeper agent’ AI assistants can sabotage your code without you realizing

The malicious code in xz versions 5.6.0 and 5.6.1 has been obfuscated, Red Hat says, and is only fully present in the source code tarball. Second-stage artifacts within the Git repo get turned into malicious code through the M4 macro in the repo during the build process. The resulting poisoned xz library is unwittingly used by software, such as the operating system’s systemd, after the library has been distributed and installed. The malware appears to have been engineered to alter the operation of OpenSSH server daemons that employ the library via systemd.

“The resulting malicious build interferes with authentication in sshd via systemd,” Red Hat explains. “SSH is a commonly used protocol for connecting remotely to systems, and sshd is the service that allows access.”

This authentication interference has the potential to allow a miscreant to break sshd authentication and remotely gain unauthorized access to an affected system. In summary, the backdoor appears to work like this: Linux machines install the backdoored xz library – specifically, liblzma – and this dependency in turn is ultimately used in some way by the computer’s OpenSSH daemon. At that point, the poisoned xz library is able to meddle with the daemon, and potentially allow an unauthorized miscreant to log in remotely.

As Red Hat put it:

A post to the Openwall security mailing list by Andres Freund, PostgreSQL developer and commiter, explores the vulnerability in greater detail.

AI hallucinates software packages and devs download them

READ MORE

“The backdoor initially intercepts execution by replacing the ifunc resolvers crc32_resolve(), crc64_resolve() with different code, which calls _get_cpuid(), injected into the code (which previously would just be static inline functions). In xz 5.6.1 the backdoor was further obfuscated, removing symbol names,” Freund explains, with the caveat that he’s not a security researcher or reverse engineer.

Freund speculates that the code “seems likely to allow some form of access or other form of remote code execution.”

The account name associated with the offending commits, together with other details like the time those commits were made, has led to speculation that the author of the malicious code is a sophisticated attacker, possibly affiliated with a nation-state agency.

The US government’s Cybersecurity and Infrastructure Security Agency (CISA) has already issued an advisory here. ®

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : The Register – https://go.theregister.com/feed/www.theregister.com/2024/03/29/malicious_backdoor_xz/

Tags: backdoormalicioustechnology
Previous Post

Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching

Next Post

Sega grabs tech layoff baton and dumps couple hundred Euro staff

China’s energy dominance in three charts – MIT Technology Review

How China Is Powering Its Energy Dominance: A Visual Breakdown

July 13, 2025
Bucks will reportedly face competition from Lakers for Warriors champion – Yahoo Sports

Bucks Set to Battle Lakers in Pursuit of Warriors Champion

July 13, 2025
LA Tech names Thornton new head of School of Human Ecology – Lincoln Parish Journal

LA Tech names Thornton new head of School of Human Ecology – Lincoln Parish Journal

July 12, 2025
New study bridges a long-standing gap in river science – cosmosmagazine.com

Breakthrough Study Unveils Missing Link in River Science

July 12, 2025
A Denver dino museum makes a find deep under own parking lot – NBC News

A Denver dino museum makes a find deep under own parking lot – NBC News

July 12, 2025
I am a neurologist, these are my ‘top 10 lifestyle and dietary tips to reduce the risk of chronic diseases and promote healthy longevity’ – The Indian Express

My Top 10 Lifestyle and Dietary Secrets to Prevent Chronic Diseases and Boost Healthy Longevity

July 12, 2025
Trump’s Big Beautiful Bill Has A Nasty Surprise For World Cup Tourists – Forbes

Trump’s Big Beautiful Bill Holds a Shocking Twist for World Cup Tourists

July 12, 2025
Issa says Medicaid-cutting bill will be good for economy – The East County Californian

Issa Claims Medicaid-Cutting Bill Will Boost the Economy

July 12, 2025
Emily Deschanel was scolded during “Bones” season 1 for being ‘late and unprepared’: ‘I was just beside myself’ – Yahoo

Emily Deschanel was scolded during “Bones” season 1 for being ‘late and unprepared’: ‘I was just beside myself’ – Yahoo

July 12, 2025
RFK Jr. Cancels Meeting of Key Preventive Health Panel – The New York Times

RFK Jr. Abruptly Cancels Crucial Preventive Health Panel Meeting

July 12, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (718)
  • Economy (741)
  • Entertainment (21,628)
  • General (15,860)
  • Health (9,778)
  • Lifestyle (748)
  • News (22,149)
  • People (742)
  • Politics (751)
  • Science (15,959)
  • Sports (21,240)
  • Technology (15,726)
  • World (724)

Recent News

China’s energy dominance in three charts – MIT Technology Review

How China Is Powering Its Energy Dominance: A Visual Breakdown

July 13, 2025
Bucks will reportedly face competition from Lakers for Warriors champion – Yahoo Sports

Bucks Set to Battle Lakers in Pursuit of Warriors Champion

July 13, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version