OpenSSH has urgently addressed a critical vulnerability affecting some Alpine Linux servers that could allow unauthorized access. The flaw permits attackers to log into accounts without passwords under specific configurations, posing a significant security risk.
Impacted Systems and Conditions
The issue affects Alpine Linux servers utilizing the standard openssh-server package without the Pluggable Authentication Module (PAM). This is particularly concerning as password logins are enabled by default in these environments. The flaw is linked to Alpine’s reliance on musl, a C library, which differs from the glibc used in other Linux distributions.
According to Damien Miller from the OpenSSH project, systems built on non-Linux platforms or those using glibc and PAM for password verification are not susceptible. For immediate protection, Miller advises setting PasswordAuthentication to ‘no’ or disabling SSH access on vulnerable systems.
Understanding the Flaw
The vulnerability arises when sshd, the OpenSSH server, checks passwords without PAM. An attacker needs network access, a username, and a password between 257 and 1,024 bytes to exploit the flaw. The attack succeeds when an account with no password exists alongside another account with a password hash starting with $5$ or $6$.
This flaw is not limited to Alpine Linux. Similar issues could potentially affect other musl-based systems like OpenWrt, Buildroot, and Yocto. However, OpenWrt typically uses Dropbear for SSH, which is not impacted.
Mitigation and Future Outlook
To address the vulnerability, OpenSSH released version 10.6p2, and Alpine Linux has updated packages from version 3.16 onwards. Users should upgrade their systems and restart the SSH service to apply the fix. For additional security, disabling password logins can prevent exploitation.
Alpine’s security advisory includes steps to update packages and modify SSH configurations. If upgrading is not possible, turning off password authentication is a recommended interim measure. It is crucial for administrators to monitor logs for any unauthorized access attempts.
The rapid response to this flaw reflects an increased awareness of the risks associated with long embargo periods on vulnerabilities. The OpenSSH team emphasizes the need for swift action, especially in a landscape where AI tools can rapidly identify and exploit such weaknesses.
