OpenSSH rated an authentication flaw critical and released version 10.6p2.
Exposure is limited to Alpine Linux systems using the standard openssh-server package without PAM, with password authentication enabled, a passwordless account, and another local account with a stored password.
Alpine has issued fixed packages; the running service must be restarted after updating.
The OpenSSH team has rated the issue critical and released the 10.6p2 fix. Alpine has also released fixed packages.
Which computers are at risk?
The problem affects computers that use Alpine's standard OpenSSH package without the additional PAM user control system. They must also allow password login and have at least one passwordless account, as well as another local account with a stored password. The attacker must know the name of the passwordless account. According to Alpine, a single login attempt is enough for the attack to succeed.
Passwordless accounts can be users who log in only with a digital key or users managed by a directory service. They can also be the root account in basic Alpine images since around version 3.16 or the alpine account in official tiny-cloud images.
In tiny-cloud images from versions 3.18.11 to 3.24.3, the alpine user can use a passwordless management tool to gain root privileges. These images are secure on first boot, but can be compromised if a password is added to any account. The default setting prevents direct login to the root account, but this is not enough if someone can log in to another account and gain root privileges from there.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
OpenSSH 10.6p2 fixes serious issue that could bypass password verification on some Linux distributions
↗
Computers that do not have the OpenSSH service running, those that have disabled password login, and accounts that are locked out are not affected. Cloud images that were configured via cloud-init are also excluded. OpenWrt typically uses Dropbear for remote connections, and according to Wakefield researcher Özgün Kültekin, this is not affected. OpenWrt can only be at risk if it has OpenSSH installed on it. Kültekin also mentioned Buildroot and Yocto as systems worth checking.
How to fix the problem
Alpine versions 3.21.10, 3.22.8, 3.23.8 and 3.24.4 contain the fix. Fixed packages have also been released for versions 3.16 to 3.21, although these are no longer supported. After updating the package, the OpenSSH service needs to be restarted, as the update does not restart the already running service by itself.
The OpenSSH team recommended that either the password connection or the SSH service be disabled immediately. Before disabling the password connection, it is necessary to confirm that the digital key connection is working. The current connection should remain open until a new one is successfully attempted.
Alpine recommends checking logs for successful password logins to passwordless accounts. If such a login cannot be ruled out, the company recommends assuming the computer has been compromised.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)