XZ Near Miss Sheds Light on Vulnerability, Patching Issues

Vulnerability management is one of the biggest challenges security defenders face. It becomes especially difficult when a vulnerability impacts a critical device or service. When a backdoor was discovered in XZ Utils, an open-source compression library available for Linux, defenders were on high alert. 

Using the XZ backdoor, a remote unauthenticated attacker could achieve remote code execution (RCE) in SSH servers that were using the compression utility in an unrecommended fashion. Thankfully, we got lucky. A researcher discovered the backdoor before malicious versions of XZ Utils were added to production versions of Debian, Ubuntu, and Fedora Linux, which would have impacted a significant portion of the internet.  

The calm before the (inevitable) next vulnerability in a critical library should motivate defenders and businesses to address common stumbling blocks in the vulnerability management process.