Technology1 min read

Alpine Linux Security advisory: OpenSSH-server password authentication bypass

By · Published by Everything Blog

In short

Threat actors can gain unauthorized single-attempt access to exposed systems running vulnerable OpenSSH server configurations that operate without PAM. The flaw targets systems hosting a mix of passwordless accounts and standard hashed passwords, exposing setups across edge and current releases back through version 3.16. Exploitation relies on transmitting an oversized password between 257 and 1024 bytes directed at a passwordless username. Administrators must deploy patched packages and restart the service or completely disable password-based logins to prevent intrusion.

Key points

  • System administrators should upgrade the OpenSSH package immediately to fixed versions su…: System administrators should upgrade the OpenSSH package immediately to fixed versions such as 3.21.10, 3.22.8, 3.23.8, or 3.24.4.
  • Updating the software alone is insufficient because administrators must explicitly restar…: Updating the software alone is insufficient because administrators must explicitly restart the SSH daemon to terminate the vulnerable process.
  • Environments unable to apply patches immediately can mitigate the flaw by configuring "Pa…: Environments unable to apply patches immediately can mitigate the flaw by configuring "PasswordAuthentication no" and restarting the service.

Sources checked by our analysis pipeline: 1

Security advisory: openssh-server password authentication bypass

If you run sshd

on Alpine Linux, update openssh

now and restart sshd

.

Upgrading the package alone does not replace the running daemon.

If you cannot update yet, at least disable password logins: set

PasswordAuthentication no

in your sshd configuration and restart sshd

.

Either one closes the hole.

What is the problem?

An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.

The attacker needs the name of an account whose password field is *

(an account with no password set, which is normal for key-only accounts), and

needs the machine to have at least one other account with a $5$

or $6$

password hash. The attacker then sends a very long password (257 to 1024

bytes). One user with a password is enough: it makes every account without

one reachable.

Details are in the OpenSSH 10.6p2 release notes. No CVE identifier had been assigned at the time of writing.

Who is affected?

You are affected…

Technology

More in Technology