03/04/2024
Actualité
Note d’information – Découverte d’une backdoor dans XZ Utils
Sun Zu used to say that « the general who wins a battle makes many calculations in his temple before the battle is fought. »
Attackers on the gravy train might have this ability. This is what could have happened with a supply chain attack using compromised versions of the XZ Utils data compression library affecting several Linux distributions. The backdoor was discovered by chance last Friday and could have led to a massive exploitation when the most recent version of XZ would be included in Linux.
We invite you to consult our recommendations in the attached note.
On March 29 2024, Andres Freund, a developer working at Microsoft disclosed the presence of a backdoor in XZ Utils targeting the most important security infrastructure of the internet. XZ Utils is an open source data compression tool available on almost all installations of Linux distributions. Web developers host their websites and apps on Linux. Linux comes with OpenSSH to make site administration easier. All you need to do to gain access anywhere is to wait for the most recent version of XZ to be included in Linux by creating a backdoor into it.
CVE-2024-3094 was rated with the highest possible score (CVSS score: 10.0). It allows attackers to send payloads through an SSH certificate to bypass authentication and gain control over the victim’s machine.
The malicious code was intentionally introduced by a GitHub member known as Jia Tan who joined the project in 2022 as a new maintainer. According to researchers, this operation could be conducted by state-sponsored actors to be used multiple times for years. However, the project was initially launched by Lasse Collins who decided to hand over the project to Jia Tan. The repository was disabled.
How does it work?
Versions 5.6.0 and 5.6.1 of XZ Utils contained malicious code that altered the program’s functionality when handling.lzma compression and decompression operations. These SSH- related routines made it possible for malicious programs to run with root access. With the help of this code, a user with the pre-encryption key could access the backdoored system via SSH. That individual would then possess the same degree of authority as any other approved administrator.
Recommendations
Determine which of your network’s systems might be vulnerable
Apply the protection measures suggested by the application or OS.
Ressources
- https://lists.debian.org/debian-security-announce/2024/msg00057.html
- https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
- https://news.opensuse.org/2024/03/29/xz-backdoor/
- https://archlinux.org/news/the-xz-package-has-been-backdoored/
- CISA. 2024. Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3099.
- Dan Goodin. 2024. Wired. The XZ Backdoor: Everything You Need to Know.
Debian Security. 2024. Xz-utils security update.
Meissner, Marcus. 2024. openSUSE addresses supply chain attack against xz compression library.
RedHat. 2024. Urgent security alert for Fedora Linux 40 and Fedora Rawhide users.
Runge, David. 2024. Archlinux. The xz package has been backdoored.
The Hacker News. 2024. Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution.
