News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by capitainenemo on Friday March 29, 2024 @12:49PM (#39866190)
FWIW, I did a quick check on a Devuan system. The sshd in Devuan does link to a libsystemd stub - this is to cut down on their maintenance of upstream packages. However that stub does not link to lzma.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by cf100clunk on Friday March 29, 2024 @01:08PM (#39866418)
On an MX Linux (non-systemd Debian-derived distro) box I ran ldd on /sbin/ssh and also ran:

[EDIT: this string gives cleaner results:]

  lsof -w -P -T -p $(pgrep sshd)|grep mem
and saw liblzma in the results of both, so there is some sort of similar trickery going on.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by capitainenemo on Friday March 29, 2024 @01:14PM (#39866502)
Huh. That's rather surprising. Do you know how MX Linux handles systemd? Devuan does that shimming of upstream. Do they perhaps just try to leave out certain packages?

Anyway. I did not see lzma in the results on Devuan running a process check (just in case). I did see it on a Debian.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by cf100clunk on Friday March 29, 2024 @01:24PM (#39866647)
It turns out MX uses a package called systemd-shim that seems to be the Debian one:

  $aptitude show systemd-shim
  Package: systemd-shim                    
  Version: 10-6
  State: installed
  Automatically installed: no
  Priority: extra
  Section: admin
  Maintainer: Debian QA Group <[email protected]>
  Architecture: amd64
  Uncompressed Size: 82.9 k
  Depends: libc6 (>= 2.34), libglib2.0-0 (>= 2.39.4), cgmanager (>= 0.32)
  Suggests: pm-utils
  Conflicts: systemd-shim:i386
  Breaks: systemd (< 209), systemd:i386 (< 209)
  Description: shim for systemd
  This package emulates the systemd function that are required to run the systemd helpers without using the init service
[ Parent | on HN ]