Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Summary
The decade-old *sshole vulnerability can let attackers log into some Linux devices over SSH without a password. Exploitation requires a specific combination of OpenSSH, musl, and account settings; Alpine Linux has issued an update, and OpenSSH has also released an update.Key Facts
- The vulnerability involves how OpenSSH interacts with musl, a lightweight C library used by Alpine Linux.
- The affected OpenSSH setup must use musl and must not use PAM authentication.
- A vulnerable system needs an active account with a SHA256- or SHA512-hashed password and a target account marked passwordless in /etc/shadow.
- An attacker who can reach the SSH port can exploit the flaw by entering more than 256 characters in the password field.
- Checkpoint researchers said accounts with doas or sudo rights could allow an attacker to gain root access; root accounts are protected under the default PermitRootLogin setting described in the article.
- Alpine and OpenSSH have issued updates, but the article says it is not clear which other packages may be vulnerable.
- OpenWRT was named by the vulnerability's discoverer, but it uses Dropbear for SSH by default; claims about Buildroot and Yocto were not confirmed.
- The article cites more than 1 billion downloads of Alpine's Docker Hub base image and about 22 million systems listed with SSH open on port 22, though only some may meet the exploit conditions.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
