cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

OpenSSH flaw enables logins to password-disabled musl Linux accounts

· Original article ↗

Summary

The *sshole flaw can let attackers log in to certain password-disabled accounts on musl-based Linux systems by submitting an oversized password. OpenSSH 10.6p2 fixes the issue; disabling SSH password authentication is a mitigation.

Key points

  • The flaw affects OpenSSH servers on musl-based systems, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under specific authentication conditions.
  • A password longer than musl crypt()’s 256-byte limit can cause it to return *, matching an account whose stored password hash is *.
  • Exploitation requires SSH password authentication enabled, PAM authentication disabled, an account with a * hash, and another account with a valid password hash.
  • The issue does not affect systems using glibc or systems using PAM authentication, and does not bypass passwords for accounts with valid password hashes.
  • The researcher warns that affected Alpine Linux AWS and Azure images have a default alpine account with passwordless doas privileges, potentially enabling root access.
  • The flaw is fixed in OpenSSH 10.6p2. Administrators can update OpenSSH or mitigate by disabling SSH password authentication.
  • Administrators can check SSH authentication logs for successful password logins to accounts configured with a * password field.

Article Details

Vulnerability Types
  • Password authentication bypass
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Set PasswordAuthentication no in the SSH server configuration and restart SSH.

CVE

CVE-2016-6210Openbsd · OpensshHowever, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes.

People

Ozgun KultekinDiscovered and disclosed the vulnerability; he says it has existed since 2016.

Products

Alpine Linuxdisclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering anBuildrootThe flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.OpenSSHOpenSSH flaw lets attackers log into password-disabled Linux accountsOpenWrtThe flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.YoctoThe flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.

Related Articles