Sunday, April 14, 2024

xz-utils Backdoor Affects Kali Linux Installations – How to Check for Infection

A critical vulnerability has been identified in the xz-utils package, versions 5.6.0 to 5.6.1, which harbors a backdoor capable of compromising system security.

This vulnerability, cataloged under CVE-2024-3094, poses a significant threat to the Linux ecosystem, including the widely used Kali Linux distribution, known for its robust security and penetration testing tools suite.

The Vulnerability: CVE-2024-3094

The backdoor discovered in the specified versions of xz-utils could allow an attacker to bypass sshd authentication, thereby gaining unauthorized remote access to the affected system.

Document
Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Given the ubiquity of xz-utils across various Linux distributions, the potential for widespread compromise was alarmingly high.

Fortunately, the issue was identified and addressed swiftly, mitigating the potential damage.

The vulnerability has been patched in Debian, from which Kali Linux derives much of its software base, thereby rectifying the issue for Kali users.

Impact on Kali Linux

For Kali Linux users, the vulnerability window was narrow but critical. The affected xz-utils version, 5.6.0-0.2, was available in the Kali repositories from March 26th to March 29th.

backdoor vulnerability
backdoor vulnerability

Users who updated their Kali Linux installations within this timeframe are at risk and must take immediate action to secure their systems.

If your Kali Linux system was not updated during this period, you are not at risk from this specific vulnerability.

However, staying informed and vigilant about system updates is always advisable to maintain security.

How to Check for Infection and Update

To determine if your Kali Linux system is affected, you can execute the following command in the terminal:

kali@kali:~$ apt-cache policy liblzma5 

liblzma5: 

 Installed: 5.4.5-0.3 

 Candidate: 5.6.1+really5.4.5-1 

 Version table: 

    5.6.1+really5.4.5-1 500 

       500 http://kali.download/kali kali-rolling/main amd64 Packages 

*** 5.4.5-0.3 100 

       100 /var/lib/dpkg/status

If the output indicates the installed version as 5.6.0-0.2, your system is vulnerable, and you must upgrade to the latest version, 5.6.1+really5.4.5-1. This can be achieved with the following commands:

kali@kali:~$ sudo apt update && sudo apt install -y --only-upgrade liblzma5
...
kali@kali:~$

For those seeking more detailed information on this vulnerability, several resources are available:

  • Help Net Security provides a summarized post on the details of the vulnerability.
  • Openwall features the initial disclosure of the vulnerability.
  • The National Vulnerability Database (NVD) entry for CVE-2024-3094 offers comprehensive information on the specifics of the vulnerability.

This incident serves as a reminder of the constant vigilance required in the digital age to protect against evolving cybersecurity threats.

Users are encouraged to promptly apply updates and stay informed on the latest security advisories.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Website

Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles