PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Defense in depth: XZ Utils

wiz.io | blog | #supply-chain | #linux | #xz-utils | #cve-2024-3094 | #sbom | #cloud-detection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz outlines assessment, prevention and detection steps for the XZ Utils backdoor, using agentless scanning, SBOM search and CDR with the Linux runtime sensor to answer whether you are affected.
Published
Collected

Related coverage

blog · kali.org
xz-utils backdoor: how to get started
A beginner walkthrough for reproducing the xz-utils/liblzma backdoor (CVE-2024-3094): set up a Kali VM, install backdoored liblzma 5.6.1 from Debian snapshots, and verify the compromise.
vulnerability · wiz.io
Backdoor in XZ Utils allows RCE: everything you need to know
Wiz explains CVE-2024-3094, the XZ Utils backdoor in versions 5.6.0 and 5.6.1 that could enable SSH authentication bypass and RCE on certain distros; about 2% of cloud environments were affected.
vulnerability · hackerone.com
XZ Utils CVE-2024-3094: A Tale of Broken Trust, Curious Persistence, and a Call to Action
A backdoor in XZ Utils 5.6.0 and 5.6.1 (CVE-2024-3094) surfaced when Andres Freund noticed sshd slowdowns; the code hid in compressed test files after a long-grooming supply chain effort.
vulnerability · bugcrowd.com
Supply Chain Backdoors, xz/liblzma, CVE-2024-3094, and what we currently know
Summarizes the xz/liblzma CVE-2024-3094 supply chain backdoor: Microsoft's Andres Freund noticed odd SSH CPU usage and 500ms delays, uncovering a backdoor planted by long-term contributor Jia Tan.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
Attackers use compromised npm packages to spread malware in minutes. Discover how Wiz detects malicious packages at publication using AI and dynamic analysis.
Back