Linux 差D被植入後門

https://thehackernews.com/2024/0 ... or-found-in-xz.html

籠裏雞，有權限編寫員故意植入後門，被及時發現

0

0

s20012797

進階會員

Rank: 3 Rank: 3 Rank: 3

2^#

發表於 2024-4-1 18:20 | 只看該作者

Evidence shows that the packages are only present in Fedora 41 and Fedora Rawhide, and do not impact distros like Alpine Linux, Amazon Linux, Debian Stable, Gentoo Linux, Linux Mint, Red Hat Enterprise Linux (RHEL), SUSE Linux Enterprise and Leap, and Ubuntu.

TOP

Okt04175

進階會員

Rank: 3 Rank: 3 Rank: 3

3^#

發表於 2024-4-2 18:37 | 只看該作者

本帖最後由 Okt04175 於 2024-4-2 18:38 編輯

Evidence shows that the packages are only present in Fedora 41 and Fedora Rawhide, and do not impact ...
s20012797 發表於 2024-4-1 18:20

簡言之受波及嘅Linux系統只有Fedora，得Fedora係包埋XZ Utils，XZ Utils並唔係Linux核心嘅一部份。

TOP

DMelon

中級會員

Rank: 2 Rank: 2

4^#

發表於 2024-4-2 23:04 | 只看該作者

籠裏雞，有權限編寫員故意植入後門，被及時發現
peacehoperisc 發表於 2024-4-1 12:05

並不意外。

TOP

DMelon

中級會員

Rank: 2 Rank: 2

5^#

發表於 2024-4-2 23:06 | 只看該作者

簡言之受波及嘅Linux系統只有Fedora，得Fedora係包埋XZ Utils，XZ Utils並唔係Linux核心嘅一部份。 ...
Okt04175 發表於 2024-4-2 18:37

下面仲有寫.........

Out of an abundance of caution, Fedora Linux 40 users have been recommended to downgrade to a 5.4 build. Some of the other Linux distributions impacted by the supply chain attack are below -

Arch Linux (installation medium 2024.03.01, virtual machine images 20240301.218094 and 20240315.221711, and container images created between and including 2024-02-24 and 2024-03-28)
Kali Linux (between March 26 and 29)
openSUSE Tumbleweed and openSUSE MicroOS (between March 7 and 28)
Debian testing, unstable, and experimental versions (from 5.5.1alpha-0.1 to 5.6.1-1)

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an alert of its own, urging users to downgrade XZ Utils to an uncompromised version (e.g., XZ Utils 5.4.6 Stable).

(The story was updated after publication to update the list of Linux distributions impacted by CVE-2024-3094.)

TOP

Okt04175