News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by glandium on Saturday March 30, 2024 @05:21PM (#39878789)
Oh, that one is interesting, because it only breaks it in cmake.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by sn on Saturday March 30, 2024 @06:12PM (#39879182)
I wonder if there is anything else cmake related that should be looked at.

Wasn't cmake support originally added to xz to use with Windows and MSVC?

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by glandium on Saturday March 30, 2024 @06:35PM (#39879354)
But that's a check for a Linux feature. So the more interesting question would be, what in the Linux world might be building xz-utils with cmake, I guess using ExternalProject_Add or something similar.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by sn on Saturday March 30, 2024 @07:41PM (#39879760)
Yes this is Linux.

At this time we don't know exactly how much is affected and what originally drew the attention of the attacker(s).

[ Parent | on HN ]