OpenSSH flaw lets attackers log into password-disabled Linux accounts
Attackers can log into accounts with asterisk password hashes on musl-based systems by submitting oversized passwords; fixed in OpenSSH 10.6p2.
A flaw in OpenSSH allows attackers to log in to Linux accounts configured to block password authentication on musl-based distributions such as Alpine Linux. The issue arises from changes made in 2016 to address username enumeration risks, where oversized passwords trigger password verification errors on systems using the musl C library. Security researcher Ozgun Kultekin discovered the vulnerability through extensive testing and reports it is not exploitable on glibc-based systems or those with PAM enabled. The flaw has been fixed in OpenSSH 10.6p2, and administrators are advised to update or temporarily disable password authentication.
Unconfirmed: No public reports of in-the-wild exploitation; exploitation conditions require specific setup including valid hash on another account
- Only affects musl-based systems including Alpine Linux, OpenWrt, Buildroot, and Yocto
- Requires at least one account with * password hash and another with valid hash
- Fixed in OpenSSH 10.6p2
- Alpine AWS and Azure images include vulnerable default alpine account
- PAM authentication disabled by default on Alpine openssh-server
Impact: Login to password-blocked accounts
- 1.Upgrade to OpenSSH 10.6p2
- 2.Disable PasswordAuthentication no in sshd_config
- 3.Check /var/log/messages for Accepted password entries
- Vendors
- OpenSSH
- Organizations
- Alpine Linux
From the original article
3 min read at bleepingcomputer.com
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.