OpenSSH flaw lets oversized passwords into some musl Linux accounts
A flaw in OpenSSH on some musl-based Linux systems lets an attacker log in to accounts configured to reject password authentication by submitting an oversized password, BleepingComputer reported on November 5. The issue affects OpenSSH servers on systems such as Alpine Linux, OpenWrt, Buildroot and Yocto when specific authentication settings are present.
Security researcher Ozgun Kultekin, who disclosed the issue, said the flaw has existed since 2016. It results from the way OpenSSH handles accounts without usable password hashes together with the musl C library’s crypt() function, according to the report.
Administrators can disable password access by placing an asterisk in an account’s /etc/shadow password field. OpenSSH nevertheless performs password hashing for such accounts to reduce username-enumeration leaks. On musl systems, crypt() also returns an asterisk when the submitted password exceeds its 256-byte limit, so OpenSSH can compare two asterisks and accept the login.
The attack requires all of the reported conditions: OpenSSH must run on a musl-based system, PAM authentication must be disabled, SSH password authentication must be enabled, one account must use an asterisk as its password hash, and another account must have a valid password hash. Systems using glibc, including Debian, Ubuntu and Fedora, and systems using PAM authentication are not vulnerable to this attack, the report said.
Kultekin warned that Alpine Linux’s official AWS and Azure images contain an affected default alpine account with passwordless doas privileges. On those images, a successful login could therefore allow an attacker to gain root access, according to the report.
OpenSSH fixes the flaw in version 10.6p2. Alpine Linux administrators are advised to update the OpenSSH package with apk upgrade openssh. Administrators who cannot update immediately can set PasswordAuthentication no in the SSH configuration and restart the server, Kultekin said.
Kultekin also recommended checking SSH authentication logs for password-based logins to accounts that should reject them. On Alpine Linux, grep "Accepted password" /var/log/messages can reveal successful password logins; a successful password login for the alpine account combined with an asterisk in its /etc/shadow entry could indicate exploitation, according to the report.