Path: ...!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Physfitfreak <physfitfreak@gmail.com>
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Sun, 31 Mar 2024 11:46:02 -0500
Organization: Modern Human
Message-ID: <uuc40a$22uoo$1@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Sun, 31 Mar 2024 16:46:03 -0000 (UTC)
Injection-Info: solani.org;
	logging-data="2194200"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:Wd2poILIUVbta+A8q3Gk9+qPTN4=
In-Reply-To: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
X-User-ID: eJwFwYEBwCAIA7CXZNCK5wjS/09YAqexdxAMCNKe5LyXMy/0kTLN9asVdVpl57yudDN8c21WNRkRgiOh/AGODRZo
Content-Language: en-US
Bytes: 2064
Lines: 32

On 3/31/24 08:01, Farley Flud wrote:
> Run this command to check if liblzma is linked to ssh:
> 
> ldd "$(command -v sshd)"
> 
> For example, on Gentoo (the best distro) I get:
> 
> 	linux-vdso.so.1 (0x00007ffff7fcb000)
>          libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
>          libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
>          libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
>          libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
>          /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
> 
> Nope.  There ain't no linking to liblzma, thus Gentoo is NOT affected
> regardless of what version of xz-utils is installed.
> 
> Systemd is ultimately responsible and more and more hackers will be
> looking for more and better ways of exploiting that 3 million loc
> pile of junk.
> 
> Don't say we didn't tell you so.
> 
> To save your systems, downgrade xz-utils AND eliminate systemd.
> 
> 


I get:

ldd: ./: not regular file