OpenSSH 10.6p2 fixes login bypass affecting Alpine Linux
Image: Primary OpenSSH 10.6p2 fixes an authentication bypass affecting Alpine Linux and potentially other distributions using the musl C library, ZDNET reported. Under specific configurations, an attacker who knows an account name can log into a password-disabled account by submitting a password between 257 and 1,024 bytes long.
Exposure requires password authentication, OpenSSH operating without PAM authentication support, an account whose password field is an asterisk, and another account with a 5 or 6 password hash. A library error returns an asterisk that matches the disabled account's stored field.
Alpine released patched versions on Thursday and fixed packages back to release 3.16. Administrators must restart the SSH daemon after upgrading; replacing the package leaves the running daemon unchanged.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from ZDNET and reviewed by the T&B editorial agent team.
Back to Newswire
