{"id":114688,"date":"2024-04-01T00:25:54","date_gmt":"2024-03-31T22:25:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vremya-sverit-versii-v-linux-vyyavlena-izoshhryonnaya-ataka-na-czepochku-postavok"},"modified":"2024-04-01T00:25:54","modified_gmt":"2024-03-31T22:25:54","slug":"vremya-sverit-versii-v-linux-vyyavlena-izoshhryonnaya-ataka-na-czepochku-postavok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vremya-sverit-versii-v-linux-vyyavlena-izoshhryonnaya-ataka-na-czepochku-postavok","title":{"rendered":"Il est temps de v\u00e9rifier les versions : une attaque sophistiqu\u00e9e sur la cha\u00eene d'approvisionnement a \u00e9t\u00e9 d\u00e9tect\u00e9e dans Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Du code malveillant a \u00e9t\u00e9 d\u00e9couvert dans xz\/liblzma, visant \u00e0 obtenir un acc\u00e8s distant non autoris\u00e9 via SSH (backdoor) et \u00e0 ex\u00e9cuter des commandes (CVE-2024-3094). Le malware a \u00e9t\u00e9 int\u00e9gr\u00e9 dans les versions 5.6.0 et 5.6.1 et, selon OpenNet, a r\u00e9ussi \u00e0 se frayer un chemin dans les builds et d\u00e9p\u00f4ts de Gentoo, Arch Linux, Debian sid\/unstable, Fedora Rawhide\/40-beta, openSUSE factory\/tumbleweed, LibreELEC, Alpine edge, Solus, CRUX, Cygwin, MSYS2 mingw, HP-UX, Homebrew, KaOS, NixOS unstable, OpenIndiana, Parabola, PCLinuxOS, OpenMandriva cooker et rolling, pkgsrc current, Slackware current, Manjaro, Void Linux. Cependant, le backdoor ne peut pas \u00eatre activ\u00e9 partout. La situation est aggrav\u00e9e par le fait que le d\u00e9veloppeur, soup\u00e7onn\u00e9, a \u00e9galement particip\u00e9 ces derni\u00e8res ann\u00e9es \u00e0 des projets connexes de la communaut\u00e9. Il n'y a donc aucune raison de faire confiance au code source de xz tant que tous les d\u00e9tails et cons\u00e9quences de l'incident ne sont pas clarifi\u00e9s. En particulier, le d\u00e9p\u00f4t concern\u00e9 sur GitHub est d\u00e9j\u00e0 bloqu\u00e9 avec le message : \u00ab L'acc\u00e8s \u00e0 ce d\u00e9p\u00f4t a \u00e9t\u00e9 bloqu\u00e9 par les employ\u00e9s de GitHub en raison d'une violation des conditions de service de GitHub \u00bb.
Source : 3dnews.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 xz\/liblzma \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e SSH (\u0431\u044d\u043a\u0434\u043e\u0440) \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 (CVE-2024-3094). \u0417\u043b\u043e\u0432\u0440\u0435\u0434 \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 5.6.0 \u0438 5.6.1 \u0438, \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 OpenNet, \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Gentoo, Arch Linux, Debian sid\/unstable, Fedora Rawhide\/40-beta, openSUSE factory\/tumbleweed, LibreELEC, Alpine edge, Solus, CRUX, Cygwin, MSYS2 mingw, HP-UX, Homebrew, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114688","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Il est temps de v\u00e9rifier les versions : une attaque sophistiqu\u00e9e sur la cha\u00eene d'approvisionnement a \u00e9t\u00e9 d\u00e9tect\u00e9e sous Linux | ProHoster","description":"Du code malveillant a \u00e9t\u00e9 d\u00e9tect\u00e9 dans xz\/liblzma, visant \u00e0 obtenir un acc\u00e8s \u00e0 distance non autoris\u00e9 via SSH (backdoor) et \u00e0 ex\u00e9cuter des commandes (CVE-2024-3094).","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vremya-sverit-versii-v-linux-vyyavlena-izoshhryonnaya-ataka-na-czepochku-postavok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0440\u0435\u043c\u044f \u0441\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u0438: \u0432 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438\u0437\u043e\u0449\u0440\u0451\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a | ProHoster","og:description":"\u0412 xz\/liblzma \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e SSH (\u0431\u044d\u043a\u0434\u043e\u0440) \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 (CVE-2024-3094).","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vremya-sverit-versii-v-linux-vyyavlena-izoshhryonnaya-ataka-na-czepochku-postavok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-31T22:25:54+00:00","article:modified_time":"2024-03-31T22:25:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/114688","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=114688"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/114688\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=114688"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=114688"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=114688"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}