A newly disclosed flaw involving OpenSSH and the musl C library lets attackers log into some Alpine Linux and other musl-based accounts that are set to block password logins, simply by sending an oversized password, BleepingComputer reported on Nov. 6. The flaw, dubbed “*sshole,” is fixed in OpenSSH 10.6p2.
Related: Japan Commits ¥10 Billion as Breach Crisis Triggers Cyber Rescue Plan.
How the flaw works
Linux admins can block password logins on an account by putting an asterisk (*) in place of its password hash, BleepingComputer reported. A 2016 OpenSSH patch for a username-guessing bug made the software hash passwords even for such accounts, according to the report.
On musl systems, the library’s crypt() function also returns an asterisk when hashing fails, including for passwords over its 256-byte limit, BleepingComputer said. An attacker’s oversized password can therefore produce an asterisk that matches the stored one, granting a login. Accounts with real password hashes are not affected.
Who is at risk
Security researcher Ozgun Kultekin, who found the flaw, said exploitation needs OpenSSH on a musl system such as Alpine Linux, OpenWrt, Buildroot or Yocto, with PAM authentication off and SSH password logins on, BleepingComputer reported. Alpine’s openssh-server package disables PAM by default.
Kultekin warned that Alpine’s official AWS and Azure cloud images include an affected “alpine” account with passwordless “doas” privileges, which could give attackers root access, according to the report. Systems using glibc, including Debian, Ubuntu and Fedora, are not vulnerable. Kultekin said he found the flaw using AI agents that ran about 17,600 login tests.
What admins should do
Alpine admins should run apk upgrade openssh, BleepingComputer reported. Those who cannot update right away can set PasswordAuthentication no in the SSH server configuration and restart SSH. Admins can also check logs for password logins to accounts that should not allow them. More security coverage is in Technology.
Sources
Read next in Technology
Most read this week
- Abdul El-Sayed and the Muslim Brotherhood Claims: What’s Confirmed and What Isn’t
- Stock Futures Erase a 2.4% Overnight Drop as Markets Digest Democrats’ Sweep of Congress
- Spain Transport Minister Óscar Puente Quits 26 Days Before Election Over Crash That Killed 69
- GM Korea’s Sales Jump 26.6% on Chevrolet Exports as Hyundai Slips 6.3% and Korean Factory Growth Cools
- Boston Plans to Close 3 Schools in 2028 as Enrollment Drops as Much as 58%
Latest
- CENTCOM Launches a Podcast With Adm. Cooper Eight Months Into the Iran War, Drawing Criticism
- Hegseth Clears National Guard in D.C. to Use Patrol Cars, Tactical Vehicles and Boats
- First 8 of 86 USS Arizona Unknowns Disinterred in Honolulu for DNA Identification
- SpaceX Launches Classified USSF-432 Mission for the Space Force From Vandenberg
- Marines Reactivate the “Silver Eagles” as an F-35C Squadron at Cherry Point