* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Friday, June 13, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Op-Ed: Data Storage and Protection in Today’s Media & Entertainment Industry – Sports Video Group

    How Data Storage and Protection Are Transforming the Media & Entertainment Industry

    The Analyst Verdict: PENN Entertainment In The Eyes Of 7 Experts – Nasdaq

    7 Experts Reveal the Ultimate Verdict on PENN Entertainment

    3 Arts Entertainment Expands Into News With Acquisition of OManagement (Exclusive) – The Hollywood Reporter

    3 Arts Entertainment Expands Into News With Acquisition of OManagement (Exclusive) – The Hollywood Reporter

    Leading Proxy Advisory Firm Glass Lewis Recommends Shareholders Vote “FOR” Both of PENN Entertainment’s Director Nominees on the WHITE Proxy Card – Business Wire

    Glass Lewis Urges Shareholders to Support All PENN Entertainment Director Nominees on the WHITE Proxy Card

    Cisco Partners with Monumental Sports & Entertainment to Power New D.C. Arena – Cisco Newsroom

    Cisco Teams Up with Monumental Sports & Entertainment to Revolutionize the New D.C. Arena Experience

    Middle Eastern Entertainment Headlines at 5:49 a.m. GMT – Yahoo

    Exciting Updates from the Middle Eastern Entertainment Scene!

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    “Co-creation” boosts commercial technology for dual-use defense applications – Breaking Defense

    “Co-creation” boosts commercial technology for dual-use defense applications – Breaking Defense

    MSI Viking and Mahr Host Technology Day – WSPA 7NEWS

    Step Inside the Thrilling World of MSI Viking and Mahr Technology Day!

    6.12pm is the new 8pm – Go Technology – cgastrategy.com

    6.12pm is the new 8pm – Go Technology – cgastrategy.com

    Russian Scientists Develop Sub-Ångström Technology for Next-Gen Quantum Processors – The Quantum Insider

    Russian Scientists Pioneer Sub-Ångström Technology to Revolutionize Next-Gen Quantum Processors

    Study uncovers SiPore Technology’s capacity to regulate blood glucose levels – Nutraceutical Business Review

    Study uncovers SiPore Technology’s capacity to regulate blood glucose levels – Nutraceutical Business Review

    SunHydrogen Unveils Large Hydrogen Reactor in Houston – Fuel Cells Works

    SunHydrogen Launches Groundbreaking Large-Scale Hydrogen Reactor in Houston

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Op-Ed: Data Storage and Protection in Today’s Media & Entertainment Industry – Sports Video Group

    How Data Storage and Protection Are Transforming the Media & Entertainment Industry

    The Analyst Verdict: PENN Entertainment In The Eyes Of 7 Experts – Nasdaq

    7 Experts Reveal the Ultimate Verdict on PENN Entertainment

    3 Arts Entertainment Expands Into News With Acquisition of OManagement (Exclusive) – The Hollywood Reporter

    3 Arts Entertainment Expands Into News With Acquisition of OManagement (Exclusive) – The Hollywood Reporter

    Leading Proxy Advisory Firm Glass Lewis Recommends Shareholders Vote “FOR” Both of PENN Entertainment’s Director Nominees on the WHITE Proxy Card – Business Wire

    Glass Lewis Urges Shareholders to Support All PENN Entertainment Director Nominees on the WHITE Proxy Card

    Cisco Partners with Monumental Sports & Entertainment to Power New D.C. Arena – Cisco Newsroom

    Cisco Teams Up with Monumental Sports & Entertainment to Revolutionize the New D.C. Arena Experience

    Middle Eastern Entertainment Headlines at 5:49 a.m. GMT – Yahoo

    Exciting Updates from the Middle Eastern Entertainment Scene!

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    “Co-creation” boosts commercial technology for dual-use defense applications – Breaking Defense

    “Co-creation” boosts commercial technology for dual-use defense applications – Breaking Defense

    MSI Viking and Mahr Host Technology Day – WSPA 7NEWS

    Step Inside the Thrilling World of MSI Viking and Mahr Technology Day!

    6.12pm is the new 8pm – Go Technology – cgastrategy.com

    6.12pm is the new 8pm – Go Technology – cgastrategy.com

    Russian Scientists Develop Sub-Ångström Technology for Next-Gen Quantum Processors – The Quantum Insider

    Russian Scientists Pioneer Sub-Ångström Technology to Revolutionize Next-Gen Quantum Processors

    Study uncovers SiPore Technology’s capacity to regulate blood glucose levels – Nutraceutical Business Review

    Study uncovers SiPore Technology’s capacity to regulate blood glucose levels – Nutraceutical Business Review

    SunHydrogen Unveils Large Hydrogen Reactor in Houston – Fuel Cells Works

    SunHydrogen Launches Groundbreaking Large-Scale Hydrogen Reactor in Houston

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

Malicious SSH backdoor sneaks into xz, Linux world’s data compression library

March 30, 2024
in Technology
Malicious SSH backdoor sneaks into xz, Linux world’s data compression library
Share on FacebookShare on Twitter

Red Hat on Friday warned that a malicious backdoor found in the widely used data compression software library xz may be present in instances of Fedora Linux 40 and in the Fedora Rawhide developer distribution.

The IT giant said the malicious code, which appears to provide remote backdoor access via OpenSSH and systemd at least, is present in xz 5.6.0 and 5.6.1. The vulnerability has been designated CVE-2024-3094. It is rated 10 out of 10 in CVSS severity.

Users of Fedora Linux 40 may have received 5.6.0, depending upon the timing of their system updates, according to Red Hat. And users of Fedora Rawhide, the current development version of what will become Fedora Linux 41, may have received 5.6.1. Fedora 40 and 41 have not been officially released yet; version 40 is due out next month.

Users of other Linux and OS distributions should check to see which version of the xz suite they have installed. The infected versions, 5.6.0 and 5.6.1, were released on February 24 and March 9, respectively, and may not been incorporated into too many people’s deployments.

This supply-chain compromise may have been caught early enough to prevent widespread exploitation, and it may only mainly affect bleeding-edge distros that picked up the latest xz versions right away.

Debian Unstable and Kali Linux have indicated they are, like Fedora, affected; all users should take action to identify and remove any backdoored builds of xz.

“PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or personal activity,” the IBM subsidiary’s advisory shouted from the rooftops today. “Fedora Rawhide will be reverted to xz-5.4.x shortly, and once that is done, Fedora Rawhide instances can safely be redeployed.”

Red Hat Enterprise Linux (RHEL) is not affected.

Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching

Open source software has its perks, but supply chain risks can’t be ignored

Sysadmins: Why not simply verify there’s no backdoor in every program you install, and thus avoid any cyber-drama?

CIOs largely believe their software supply chain is vulnerable

How ‘sleeper agent’ AI assistants can sabotage your code without you realizing

The malicious code in xz versions 5.6.0 and 5.6.1 has been obfuscated, Red Hat says, and is only fully present in the source code tarball. Second-stage artifacts within the Git repo get turned into malicious code through the M4 macro in the repo during the build process. The resulting poisoned xz library is unwittingly used by software, such as the operating system’s systemd, after the library has been distributed and installed. The malware appears to have been engineered to alter the operation of OpenSSH server daemons that employ the library via systemd.

“The resulting malicious build interferes with authentication in sshd via systemd,” Red Hat explains. “SSH is a commonly used protocol for connecting remotely to systems, and sshd is the service that allows access.”

This authentication interference has the potential to allow a miscreant to break sshd authentication and remotely gain unauthorized access to an affected system. In summary, the backdoor appears to work like this: Linux machines install the backdoored xz library – specifically, liblzma – and this dependency in turn is ultimately used in some way by the computer’s OpenSSH daemon. At that point, the poisoned xz library is able to meddle with the daemon, and potentially allow an unauthorized miscreant to log in remotely.

As Red Hat put it:

A post to the Openwall security mailing list by Andres Freund, PostgreSQL developer and commiter, explores the vulnerability in greater detail.

AI hallucinates software packages and devs download them

READ MORE

“The backdoor initially intercepts execution by replacing the ifunc resolvers crc32_resolve(), crc64_resolve() with different code, which calls _get_cpuid(), injected into the code (which previously would just be static inline functions). In xz 5.6.1 the backdoor was further obfuscated, removing symbol names,” Freund explains, with the caveat that he’s not a security researcher or reverse engineer.

Freund speculates that the code “seems likely to allow some form of access or other form of remote code execution.”

The account name associated with the offending commits, together with other details like the time those commits were made, has led to speculation that the author of the malicious code is a sophisticated attacker, possibly affiliated with a nation-state agency.

The US government’s Cybersecurity and Infrastructure Security Agency (CISA) has already issued an advisory here. ®

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : The Register – https://go.theregister.com/feed/www.theregister.com/2024/03/29/malicious_backdoor_xz/

Tags: backdoormalicioustechnology
Previous Post

Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching

Next Post

Sega grabs tech layoff baton and dumps couple hundred Euro staff

Landscape-explicit phylogeography illuminates the ecographic radiation of early archosauromorph reptiles – Nature

Landscape-explicit phylogeography illuminates the ecographic radiation of early archosauromorph reptiles – Nature

June 13, 2025
Students Shine at International Science Fair – NewsForKids.net

Students Shine at International Science Fair – NewsForKids.net

June 13, 2025
Science Under Fire in Washington – The Equation – Union of Concerned Scientists

Science Under Fire in Washington – The Equation – Union of Concerned Scientists

June 13, 2025
If you want to become classier and more cultured as you age, say goodbye to these 7 habits – VegOut

7 Habits to Ditch Now if You Want to Grow Classier and More Cultured with Age

June 13, 2025
Which 10 teams have the best odds to win the 2026 World Cup, one year out? – FOX Sports

Which 10 teams have the best odds to win the 2026 World Cup, one year out? – FOX Sports

June 13, 2025
JPMorgan CEO: ‘Real Chance’ US Economic Numbers Will Dip – PYMNTS.com

JPMorgan CEO: ‘Real Chance’ US Economic Numbers Will Dip – PYMNTS.com

June 13, 2025

First karaoke machine recognized as entertainment tech “milestone” – Kyodo News+ | Japan’s leading news agency.

June 13, 2025
OSU-CHS recognized for health and wellness initiatives – Oklahoma State University

OSU-CHS Honored for Exceptional Health and Wellness Programs

June 13, 2025
Rand Paul attacks ‘immaturity’ of White House after rescinded picnic invitation, says he’s lost a ‘lot of respect’ for Trump – CNN

Rand Paul attacks ‘immaturity’ of White House after rescinded picnic invitation, says he’s lost a ‘lot of respect’ for Trump – CNN

June 13, 2025
“Co-creation” boosts commercial technology for dual-use defense applications – Breaking Defense

“Co-creation” boosts commercial technology for dual-use defense applications – Breaking Defense

June 12, 2025

Categories

Archives

June 2025
MTWTFSS
 1
2345678
9101112131415
16171819202122
23242526272829
30 
« May    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (683)
  • Economy (698)
  • Entertainment (21,601)
  • General (15,354)
  • Health (9,739)
  • Lifestyle (702)
  • News (22,149)
  • People (699)
  • Politics (705)
  • Science (15,915)
  • Sports (21,199)
  • Technology (15,684)
  • World (681)

Recent News

Landscape-explicit phylogeography illuminates the ecographic radiation of early archosauromorph reptiles – Nature

Landscape-explicit phylogeography illuminates the ecographic radiation of early archosauromorph reptiles – Nature

June 13, 2025
Students Shine at International Science Fair – NewsForKids.net

Students Shine at International Science Fair – NewsForKids.net

June 13, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version