xz 工具供应链后门事件 紧急处理

xz --versionbrew uninstall --ignore-dependencies xzbrew uninstall --force xzxz --version

brew updatebrew upgrade

#!/bin/bash# CVE-2024-3094-checker.sh# Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed# https://nvd.nist.gov/vuln/detail/CVE-2024-3094# Author Baroni Fabio
# This shell script is provided as-is and without warranty of any kind, express or implied.# By executing this script, you acknowledge that you do so at your own risk.# The author(s) of this script shall not be liable for any damages or issues that may arise from its use, including but not limited to data loss, system instability, or any other unintended consequences. # It is recommended to review the script and understand its functionality before running it, and to ensure that appropriate backups are in place.# Use of this script implies your acceptance of these terms.

# Detect package managerif command -v apt-get &>/dev/null; then    PKG_MANAGER="apt-get"elif command -v yum &>/dev/null; then    PKG_MANAGER="yum"elif command -v zypper &>/dev/null; then    PKG_MANAGER="zypper"else    echo "Unsupported package manager. Exiting."    exit 1fi
if [ "$PKG_MANAGER" = "zypper" ]; then
    version=$(rpm -q xz)    if [[ $version =~ (5\.6\.(0|1)) && ! $version =~ revertto ]]; then        echo "It seems you have a vulnerable version of the xz package installed on your system"        echo "OpenSuse has released a patched version that avoids this CVE, running zypper to update the xz package..."        sudo zypper refresh        sudo zypper update xz        if [ $? -eq 0 ]; then            echo "xz package updated successfully. Now it is advisable to reboot"        else            echo "xz package update failed"        fi                if lsb_release -d | grep -q "Tumbleweed"; then            echo "OpenSuse recommends openSUSE Tumbleweed users where SSH is exposed to the internet to make a fresh installation of the system and change credentials, as it’s unknown if the backdoor has been exploited."            echo "Due to the sophisticated nature of the backdoor an on-system detection of a breach is likely not possible."            echo "Also rotation of any credentials that could have been fetched from the system is highly recommended."        fi    else        echo "Your OpenSuse installation is probably safe."    fielif [ "$PKG_MANAGER" = "apt-get" ]; then    version=$(dpkg -l | grep "xz-utils" | awk '{print $3}')    if [[ "$version" == *"5.6.0"* || "$version" == *"5.6.1"* ]]; then        echo "Vulnerable version of xz-utils found: $version"        read -p "Do you want to attempt installing the stable uncompromised xz-utils 5.4.6 version from source? (y/n): " choice        if [[ "$choice" == "y" || "$choice" == "Y" ]]; then            echo "Downloading xz-utils 5.4.6 from source..."            wget https://github.com/tukaani-project/xz/releases/download/v5.4.6/xz-5.4.6.tar.gz            tar -zxvf xz-5.4.6.tar.gz            cd xz-5.4.6            echo "Configuring xz-utils..."            ./configure            echo "Compiling xz-utils..."            make            echo "Installing xz-utils..."            sudo make install            echo "xz-utils 5.4.6 installed successfully."        else            echo "You chose not to install the package automatically. Install manually if needed. Exiting."        fi    else        echo "You appear to be safe."    fifi