Test ID:	1.3.6.1.4.1.25623.1.0.114472
Category:	Malware
Title:	Tukaani Project XZ Utils Backdoor (Feb/Mar 2024)
Summary:	The XZ Utils of the Tukaani Project have been backdoored by an; unknown threat actor in February and March 2024.
Description:	Summary: The XZ Utils of the Tukaani Project have been backdoored by an unknown threat actor in February and March 2024. Vulnerability Insight: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. Please see the references for more (technical) details / analysis. Affected Software/OS: As of 04/2024 the following Linux distributions are know to have shipped packages including the backdoor from the 5.6.0 and 5.6.1 tarball releases for a short amount of time: - Debian testing/trixie and unstable/sid - Kali Linux (Only kali-rolling between March 26th to March 29th) - openSUSE Tumbleweed and openSUSE MicroOS (between March 07th to March 28th) - Fedora 40 beta, Fedora 41 pre-release and Fedora Rawhide (current development version) - Alpine Linux Edge (active development) Note: Arch Linux and Gentoo had also shipped the known backdoored package but are not assumed to be prone to the known attack vector. Solution: Affected Linux distributions have rolled back the published packages to an older state. Please run an update via the used package manager. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2024-3094 RHBZ#2272210 https://bugzilla.redhat.com/show_bug.cgi?id=2272210 https://access.redhat.com/security/cve/CVE-2024-3094 https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/ https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 https://bugs.gentoo.org/928134 https://bugzilla.suse.com/show_bug.cgi?id=1222124 https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 https://github.com/advisories/GHSA-rxwq-x6h5-x525 https://github.com/amlweems/xzbot https://github.com/karcherm/xz-malware https://gynvael.coldwind.pl/?lang=en&id=782 https://lists.debian.org/debian-security-announce/2024/msg00057.html https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html https://lwn.net/Articles/967180/ https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39877267 https://news.ycombinator.com/item?id=39895344 https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ https://research.swtch.com/xz-script https://research.swtch.com/xz-timeline https://security-tracker.debian.org/tracker/CVE-2024-3094 https://security.alpinelinux.org/vuln/CVE-2024-3094 https://security.archlinux.org/CVE-2024-3094 https://security.netapp.com/advisory/ntap-20240402-0001/ https://tukaani.org/xz-backdoor/ https://twitter.com/LetsDefendIO/status/1774804387417751958 https://twitter.com/debian/status/1774219194638409898 https://twitter.com/infosecb/status/1774595540233167206 https://twitter.com/infosecb/status/1774597228864139400 https://ubuntu.com/security/CVE-2024-3094 https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils https://www.kali.org/blog/about-the-xz-backdoor/ https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094 https://xeiaso.net/notes/2024/xz-vuln/ http://www.openwall.com/lists/oss-security/2024/03/29/10 http://www.openwall.com/lists/oss-security/2024/03/29/12 http://www.openwall.com/lists/oss-security/2024/03/29/5 http://www.openwall.com/lists/oss-security/2024/03/29/8 http://www.openwall.com/lists/oss-security/2024/03/29/4 http://www.openwall.com/lists/oss-security/2024/03/30/12 http://www.openwall.com/lists/oss-security/2024/03/30/27 http://www.openwall.com/lists/oss-security/2024/03/30/5 http://www.openwall.com/lists/oss-security/2024/03/30/36 http://www.openwall.com/lists/oss-security/2024/04/16/5
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.