Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability
SANS researcher reports active exploitation attempts against OpenSSH SSHole flaw allowing access to password-disabled accounts; fixes available.
Attackers have started targeting the SSHole authentication bypass affecting certain OpenSSH servers. The flaw allows remote attackers to access some password-disabled Linux accounts by submitting an unusually long password. SANS Internet Storm Center recorded increasing long-password requests starting November 5. OpenSSH 10.6p2 fixes the issue; administrators should upgrade and set PasswordAuthentication no.
- Flaw affects OpenSSH running with musl libc when password checks occur without PAM
- Attack range is 257 to 1,024 bytes
- Alpine has released patched packages
Impact: remote access to password-disabled Linux accounts
- 1.Upgrade to OpenSSH 10.6p2 or later
- 2.Set PasswordAuthentication no
- Vendors
- OpenSSH
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 152.233.50.185 | uts. The leading scanner addresses included 213.86.169.133, 152.233.50.185 and 92.255.57.7, with 48, 44 and 43 recorded attempts respe |
| ipv4 | 213.86.169.133 | lving longer inputs. The leading scanner addresses included 213.86.169.133, 152.233.50.185 and 92.255.57.7, with 48, 44 and 43 recorde |
| ipv4 | 92.255.57.7 | anner addresses included 213.86.169.133, 152.233.50.185 and 92.255.57.7, with 48, 44 and 43 recorded attempts respectively. Ullrich |
From the original article
2 min read at cybersecuritynews.com
Attackers have started targeting the SSHole authentication bypass affecting certain OpenSSH servers, according to new SANS Internet Storm Center findings. The flaw allows remote attackers to access some password-disabled Linux accounts by submitting an unusually long password, without knowing valid credentials or holding an SSH key. SANS researcher Johannes Ullrich reported the first clear exploit […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.