1222
XZ backdoor in a nutshell (lemmy.zip)
submitted 2 years ago by to c/linux@lemmy.ml
155 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 2 years ago (1 child)

Authentication bypass should give you interactive access. "I'm in" like. Remote code execution only allows you to run a command, without permanent access. You can use some RCE vulnerabilities to bypass authentication, but not all.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 years ago* (last edited 2 years ago)

    Yeah, but the malicious code replaces the ssh signature verification function to let it allow a specific signature. Hence attacker, with the key, can ssh into any system without proper authentication by ssh.

    This kind of describes authentication by-pass, not just remote code execution...

    EDIT: it is remote code execution, see the edit of parent comment.

  • permalink
  • fedilink
  • source
  • parent