Tuesday, April 2, 2024

Security Onion and the xz Vulnerability

Recently, a vulnerability was reported in the xz library:

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

https://www.cve.org/CVERecord?id=CVE-2024-3094

https://nvd.nist.gov/vuln/detail/CVE-2024-3094

https://www.openwall.com/lists/oss-security/2024/03/29/4

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users


Security Onion is NOT affected by this vulnerability.


Searching for xz Vulnerability across non-Security Onion Devices


If you have Security Onion deployed in your enterprise with Elastic Agent deployed to your endpoints, you can use Osquery Manager to search for vulnerable xz packages as shown in these Github gists by James Spiteri.


Linux:

https://gist.github.com/jamesspi/ee8319f55d49b4f44345c626f80c430f


macOS:

https://gist.github.com/jamesspi/5cb060b5e0e2d43222a71c876b56daab


For example, here's the Linux query run across several Linux endpoints (hostnames excluded from the screenshot):



No comments:

Post a Comment

Note: Only a member of this blog may post a comment.