[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 31 Mar 2024 23:30:23 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: David Leadbeater <dgl@....cx>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise
On Sat, Mar 30, 2024 at 04:37:48PM -0000, Tavis Ormandy wrote:
> It was also pointed out they submitted an odd PR to libarchive:
>
> https://github.com/libarchive/libarchive/pull/1609
>
> In summary, they replaced calls to safe_fprintf() with fprintf() --
> meaning control characters are no longer filtered from errors. That
> seems pretty minor, but now that we know they were in the business of
> obfuscating the presence of backdoors -- seems a bit suspicious.
>
> Regardless, that change has now been reverted:
>
> https://github.com/libarchive/libarchive/pull/2101
This does look minor indeed - not usable for large-scale attacks, and
libarchive is quite unique in that it even bothered to filter control
characters, whereas most command-line tools outputting filenames don't
bother. My guess is it could have been an early experiment to see
whether the project would accept PRs degrading security.
That said, here's an excellent write-up by David Leadbeater on specific
ways that specific terminal emulators may be usefully attacked with
control sequences:
https://dgl.cx/2023/09/ansi-terminal-security#vulnerabilities-using-known-replies
It's been mentioned in here before. I just wish David would post a full
text version of it to oss-security in separate thread.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
