CriticalCVE
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
The Hacker News·Source published ·1 min read
What happened?
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it.
Key details
- Attackers can log in to accounts with no password on Alpine Linux servers running standard openssh-server.
- The flaw allows password bypass when sshd checks passwords without PAM and at least one other account has a $5$ or $6$ password hash.
- The fix requires updating the package and restarting sshd because the package upgrade does not restart the running daemon.
- If immediate update is not possible, disabling PasswordAuthentication stops the attack.
- OpenSSH version 10.6p2 includes the fix; Alpine point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 contain the fixed packages.
Affected
- Alpine point releases before 3.21.10, 3.22.8, 3.23.8 and 3.24.4 are affected.
- Cloud images built with tiny-cloud before the fixed point releases.
Fixes and mitigations
- Update openssh-server package and restart sshd using apk upgrade -U -a and rc-service sshd restart.
- Set PasswordAuthentication no in sshd_config and restart sshd if updating is not immediately possible.
What to look for
- sshd logs Accepted password for an account that has no password, such as alpine, root or a key-only user.
- Review doas usage, recently created users, files and authorized keys on exposed machines.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.