News for hackers. Stuff that matters.

A comment on The failed attempt to backdoor SSH globally – that got caught by chance. Parent comment

Re:The failed attempt to backdoor SSH globally – that got ca... by inopinatus on Monday April 01, 2024 @05:57AM (#39892388)
I've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356
[ Parent | on HN ]
Re:The failed attempt to backdoor SSH globally – that got ca... by usr1106 on Monday April 01, 2024 @08:11AM (#39893266)
That packaging error makes liblzma being pulled in at installation (well, it's probably already there if pid 1 requires it). But it will not make the sshd binary use it. So I think the original claim stands: Without patching sshd for the notification it will not use liblzma.

Disclaimer: I did not search for all possible occurrences of dlopen().

[ Parent | on HN ]