Month: March 2024
Huge backdoor discovered that could compromise SSH logins on Linux
Updates required for Debian sid, Fedora 40, Fedora Rawhide, openSUSE Tumbleweed, and openSUSE MicroOS
On Friday March 29, Microsoft employee Andres Freund shared that he had found odd symptoms in the xz package on Debian installations. Freund noticed that ssh login was requiring a lot of CPU and decided to investigate leading to the discovery.
The vulnerability has received the maximum security ratings with a CVS score of 10 and a Red Hat Product Security critical impact rating.
Red Hat assigned the issue CVE-2024-3094 but based on the severity and a previous major bug being named Heartbleed, the community has cheekily named the vulnerability a more vulgar name and inverted the Heartbleed logo.
Luckily the vulnerability has been caught early
Red Hat wrote: “Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.”
The malicious injection can be found only in the tarball download package of xz versions 5.6.0 and 5.6.1 libraries. The Git distribution does not include the M4 Macro that triggers the code. The second-stage artifacts are present in the Git repository for the injection during the build time, if the malicious M4 macro is present. Without the merge into the build, the 2nd-stage file is innocuous.
You are recommended to check for xz version 5.6.0 or 5.6.1 in the following distributions and downgrade to 5.4.6. If you cannot you should disable public facing SSH servers.
More from TechRadar Pro
Best managed VPS serversCheck out our top picks for best managed WordPressScalaHosting review
After Losing Billions, Disney+ Tries Integrating Hulu Into Its App
“Subscribers of both Disney+ and Hulu can now access Hulu content through the Disney+ app,” reports the Los Angeles Times, “as the Burbank media and entertainment giant launched its one-app integration of the two streaming services Wednesday…”
The move is part of Disney’s plan to increase viewer engagement and reduce churn on Disney+, which has 111.3 million subscribers globally. Disney has lost billions on its direct-to-consumer business as it tries to compete with Netflix, but the company has told investors that its streaming segment will begin to turn a profit by the end of fiscal 2024. Streaming losses have been a key component of a nasty activist shareholder campaign ahead of next week’s annual meeting.
Disney+ has typically served up family-friendly content and major brands such as Pixar, Star Wars and Marvel, whereas Hulu’s offering has been the streaming home of more adult-oriented programming. Disney executives described the combined app experience as the most extensive technical advancement to the Disney+ streaming platform since it launched in November 2019… The price of the bundle plan starts at $9.99 with ads… Upgrading to the bundle of Hulu on Disney+ will start at $2 more per month, Disney said.
Read more of this story at Slashdot.
“Subscribers of both Disney+ and Hulu can now access Hulu content through the Disney+ app,” reports the Los Angeles Times, “as the Burbank media and entertainment giant launched its one-app integration of the two streaming services Wednesday…”
The move is part of Disney’s plan to increase viewer engagement and reduce churn on Disney+, which has 111.3 million subscribers globally. Disney has lost billions on its direct-to-consumer business as it tries to compete with Netflix, but the company has told investors that its streaming segment will begin to turn a profit by the end of fiscal 2024. Streaming losses have been a key component of a nasty activist shareholder campaign ahead of next week’s annual meeting.
Disney+ has typically served up family-friendly content and major brands such as Pixar, Star Wars and Marvel, whereas Hulu’s offering has been the streaming home of more adult-oriented programming. Disney executives described the combined app experience as the most extensive technical advancement to the Disney+ streaming platform since it launched in November 2019… The price of the bundle plan starts at $9.99 with ads… Upgrading to the bundle of Hulu on Disney+ will start at $2 more per month, Disney said.
Read more of this story at Slashdot.
Texas Plays N.C. State for a Spot in the Women’s Final Four
The Longhorns are looking to join another No. 1 seed, South Carolina, in the Final Four.
The Longhorns are looking to join another No. 1 seed, South Carolina, in the Final Four.
Women’s Elite Eight: South Carolina Keeps Its Perfect Season Intact
The Gamecocks beat Oregon State to return to the Final Four for the fourth consecutive year.
The Gamecocks beat Oregon State to return to the Final Four for the fourth consecutive year.
America’s FDA Forced to Settle ‘Groundless’ Lawsuit Over Its Ivermectin Warnings
As a department of America’s federal Health agency, the Food and Drug Administration is responsible for public health rules, including prescription medicines. And the FDA “has not changed its position that currently available clinical trial data do not demonstrate that ivermectin is effective against COVID-19,” they confirmed to CNN this week. “The agency has not authorized or approved ivermectin for use in preventing or treating COVID-19.”
But there was also a lawsuit. In “one of its more popular pandemic-era social media campaigns,” the agency tweeted out “You are not a horse. You are not a cow. Seriously, y’all. Stop it.” The post attracted nearly 106,000 likes — and over 46,000 reposts, and was followed by another post on Instagram. “Stop it with the #ivermectin. It’s not authorized for treating #COVID.”
Los Angeles Times business columnist Michael Hiltzik writes that the posts triggered a “groundless” lawsuit:
It was those latter two lines that exercised three physicians who had been prescribing ivermectin for patients. They sued the FDA in 2022, asserting that its advisory illegally interfered with the practice of medicine — specifically with their ability to continue prescribing the drug. A federal judge in Texas threw out their case, but the 5th Circuit Court of Appeals — the source of a series of chuckleheaded antigovernment rulings in recent years — reinstated it last year, returning it to the original judge for reconsideration.
Now the FDA has settled the case by agreeing to delete the horse post and two similar posts from its accounts on the social media platforms X, LinkedIn and Facebook. The agency also agreed to retire a consumer advisory titled “Why You Should Not Use Ivermectin to Treat or Prevent COVID-19.” In defending its decision, the FDA said it “has chosen to resolve this lawsuit rather than continuing to litigate over statements that are between two and nearly four years old.”
That sounds reasonable enough, but it’s a major blunder. It leaves on the books the 5th Circuit’s adverse ruling, in which a panel of three judges found that the FDA’s advisory crossed the line from informing consumers, which they said is all right, to recommending that consumers take some action, which they said is not all right… That’s a misinterpretation of the law and the FDA’s actions, according to Dorit Rubinstein Reiss of UC College of the Law in San Francisco. “The FDA will seek to make recommendations against the misuse of products in the future, and having that decision on the books will be used to litigate against it,” she observed after the settlement.
“A survey by Boston University and the University of Michigan estimated that Medicare and private insurers had wasted $130 million on ivermectin prescriptions for COVID in 2021 alone.”
Read more of this story at Slashdot.
As a department of America’s federal Health agency, the Food and Drug Administration is responsible for public health rules, including prescription medicines. And the FDA “has not changed its position that currently available clinical trial data do not demonstrate that ivermectin is effective against COVID-19,” they confirmed to CNN this week. “The agency has not authorized or approved ivermectin for use in preventing or treating COVID-19.”
But there was also a lawsuit. In “one of its more popular pandemic-era social media campaigns,” the agency tweeted out “You are not a horse. You are not a cow. Seriously, y’all. Stop it.” The post attracted nearly 106,000 likes — and over 46,000 reposts, and was followed by another post on Instagram. “Stop it with the #ivermectin. It’s not authorized for treating #COVID.”
Los Angeles Times business columnist Michael Hiltzik writes that the posts triggered a “groundless” lawsuit:
It was those latter two lines that exercised three physicians who had been prescribing ivermectin for patients. They sued the FDA in 2022, asserting that its advisory illegally interfered with the practice of medicine — specifically with their ability to continue prescribing the drug. A federal judge in Texas threw out their case, but the 5th Circuit Court of Appeals — the source of a series of chuckleheaded antigovernment rulings in recent years — reinstated it last year, returning it to the original judge for reconsideration.
Now the FDA has settled the case by agreeing to delete the horse post and two similar posts from its accounts on the social media platforms X, LinkedIn and Facebook. The agency also agreed to retire a consumer advisory titled “Why You Should Not Use Ivermectin to Treat or Prevent COVID-19.” In defending its decision, the FDA said it “has chosen to resolve this lawsuit rather than continuing to litigate over statements that are between two and nearly four years old.”
That sounds reasonable enough, but it’s a major blunder. It leaves on the books the 5th Circuit’s adverse ruling, in which a panel of three judges found that the FDA’s advisory crossed the line from informing consumers, which they said is all right, to recommending that consumers take some action, which they said is not all right… That’s a misinterpretation of the law and the FDA’s actions, according to Dorit Rubinstein Reiss of UC College of the Law in San Francisco. “The FDA will seek to make recommendations against the misuse of products in the future, and having that decision on the books will be used to litigate against it,” she observed after the settlement.
“A survey by Boston University and the University of Michigan estimated that Medicare and private insurers had wasted $130 million on ivermectin prescriptions for COVID in 2021 alone.”
Read more of this story at Slashdot.