Alpine Linux Security Advisory: OpenSSH-server password authentication bypass (alpinelinux.org)

Article summary

A security advisory has been issued for Alpine Linux due to a vulnerability in the OpenSSH-server package that allows an attacker to bypass password authentication. The issue arises when an account has no password set and another account has a password hash starting with $5 or $6. To fix the issue, users can update the OpenSSH package or disable password authentication. Affected releases include every Alpine release from 3.16 to 3.24 and edge.

Main themes

• Alpine Linux security
• OpenSSH vulnerability
• password authentication bypass
• Linux distribution security
• OpenSSH-server package update

What commenters say

• The musl C library's behavior of returning an error indicator of '*' for long passwords is a deviation from the POSIX standard and contributed to the vulnerability.
• The bug was developed over decades and its detailed trace is available online.
• The choice of musl's crypt() function to return '*' as an error indicator is seen as a crazy choice and a straight-up bug.
• The vulnerability is a result of a combination of factors including the musl C library and the OpenSSH-server package configuration.
• The fix for the issue is to update the OpenSSH package or disable password authentication, and users are advised to review their system logs for signs of potential attacks.
• The behavior of musl's crypt() function is not unique and other C libraries may behave similarly.
• The vulnerability highlights the importance of adhering to POSIX standards in C library implementations.