Security Leftovers
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (fence-agents, raptor2, and rsync), Debian (chromium), Fedora (rsync and seamonkey), Mageia (openjpeg2), Red Hat (tuned), Slackware (git), SUSE (dcmtk, dnsmasq, govulncheck-vulndb, libQtWebKit4, libraptor-devel, opera, python311-Pillow, python311-translate-toolkit, rsync, and SDL2_sound-devel), and Ubuntu (linux-raspi-5.4, neomutt, and python2.7).
-
Bruce Schneier ☛ FBI Deletes PlugX Malware from Thousands of Computers
According to a DOJ press release, the FBI was able to delete the Chinese-used PlugX malware from “approximately 4,258 U.S.-based computers and networks.”
-
Cyber Security News ☛ Pumakit – A Sophisticated Linux Rootkit Attack Critical Infrastructure [Ed: So do not install it.]
In recent months, a stealthy and highly sophisticated Linux rootkit named Pumakit has been identified, targeting critical infrastructure sectors including telecommunications, finance, and national security.
-
Pumakit: A Sophisticated Linux Rootkit Targeting Critical Infrastructure [Ed: This does not explain how it gets installed in the first place, only that it exists and was found somewhere]
-
Canonical ☛ Rsync remote code execution and related vulnerability fixes available
Canonical’s security team has released updates of the rsync packages for all supported Ubuntu releases. The updates remediate CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, and CVE-2024-12747.
-
Arch Family
-
ArchLinux ☛ Critical rsync security release 3.4.0
We'd like to raise awareness about the rsync security release version 3.4.0-1 as described in our advisory ASA-202501-1.
An attacker only requires anonymous read access to a vulnerable rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on.
Additionally, attackers can take control of an affected server and read/write arbitrary files of any connected client.
Sensitive data can be extracted, such as OpenPGP and SSH keys, and malicious code can be executed by overwriting files such as ~/.bashrc or ~/.popt.
We highly advise anyone who runs an rsync daemon or client prior to version 3.4.0-1 to upgrade and reboot their systems immediately.
As Arch GNU/Linux mirrors are mostly synchronized using rsync, we highly advise any mirror administrator to act immediately, even though the hosted package files themselves are cryptographically signed.
All infrastructure servers and mirrors maintained by Arch GNU/Linux have already been updated.
-