OpenSSH flaw let long passwords unlock passwordless Alpine accounts
OpenSSH and Alpine Linux warn that attackers could bypass password authentication on certain Linux systems using musl without PAM, notably Alpine servers with SSH password login enabled. A password of 257 to 1,024 characters could log into an account marked with * when another account had a supported password hash; OpenSSH 10.6p2 and Alpine security updates address the flaw.
Bottom line — Alpine says to update OpenSSH and restart sshd, or disable password logins; the affected cloud images could expose root access through passwordless doas.
Go deeper 6
-
Alpine says an attacker needs a reachable SSH port and the name of an affected account; the bypass requires only one connection.
-
The vulnerable setup requires musl, PAM-disabled password checks, password authentication enabled, and a * account alongside another account with a $5$ or $6$ hash, according to Alpine.
-
Alpine says official tiny-cloud images from 3.18.11 through 3.24.3 include an alpine account with passwordless doas access. Once the conditions are met, a login as alpine can lead to root access.
-
OpenSSH says systems using glibc or PAM for password authentication, as well as OpenBSD and Dropbear, are unaffected.
-
Alpine advises restarting sshd after upgrading; installing the fixed package alone leaves the running daemon unchanged.
-
If an update must wait, Alpine recommends setting PasswordAuthentication no and restarting sshd. It also advises checking logs for successful password logins to passwordless accounts.
www.instagram.com