3 ms·
That one's a separate attack vector, which is seemingly unused in the sshd attack. It only disables sandboxing of the xzdec(2) utility, which is not used in the
by Denvercoder9 3y ago
That one's a separate attack vector, which is seemingly unused in the sshd attack. It only disables sandboxing of the xzdec(2) utility, which is not used in the sshd attack.
- formerly_proven 3y agoWhich strongly suggests that they planned and/or executed more backdoors via Jia Tan’s access.
- pja 3y agoI guess xzdec was supposed to sandbox itself where possible so they disabled the sandbox feature check in the build system so that future payload exploits passed to xzdec wouldn’t have to escape the sandbox in order to do anything useful? Sneaky.