[ Ссылка ]
Researchers have unearthed a malicious backdoor nestled within a widely utilized compression tool, infiltrating various Linux distributions, including Red Hat and Debian.
The tool in question, known as xz Utils, harbored the malicious code within versions 5.6.0 and 5.6.1, as discovered by developer Andres Freund. While these versions were not incorporated into major Linux distributions' production releases, recent beta releases of Red Hat's Fedora 40 and Debian's testing distributions were found to include the compromised versions.
Although no reported incidents have occurred in the real world due to the timely discovery of the backdoor, security analysts emphasize the potential catastrophic consequences had it gone undetected.
Additionally, it was revealed that certain applications bundled in the HomeBrew package manager for macOS relied on the compromised 5.6.1 version of xz Utils. HomeBrew has since reverted to a safe version to mitigate risks.
The backdoor, detected through obfuscated code injections in archived releases, notably tampered with SSH authentication mechanisms. This intrusion was orchestrated through a malevolent install script injected into functions utilized by sshd.
The backdoor's originator, identified as JiaT75, submitted the malicious changes, raising suspicions of direct involvement or severe system compromise.
Security analysts emphasize the criticality of immediate action, as the backdoor aims to circumvent SSH authentication, potentially granting unauthorized access and compromising entire systems.
Linux maintainers are swiftly responding, rolling back to safe versions and conducting comprehensive investigations to ensure the integrity of their distributions.
Linux users are advised to promptly check their systems for vulnerability and apply necessary patches. Vigilance remains paramount in safeguarding against such cyber threats.
