Decade-old flaw lets attackers SSH into some Alpine Linux devices without a password
VULNERABILITYOpenSSHredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A decade-old vulnerability in the interaction between OpenSSH and the musl C library can allow passwordless SSH logins on some Alpine Linux systems, and possibly other distributions. Exploitation requires OpenSSH built against musl without PAM, at least one account with a SHA256 or SHA512 password hash, and a target account with "" in the password field of /etc/shadow.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether any systems run Alpine Linux or other musl-based distributions with OpenSSH and without PAM.
- Review /etc/shadow for accounts with "" in the password field and restrict SSH access to them.
- Watch for vendor advisories and apply patches once a fix is published.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Ars Technica (Security)
Who and what is in it
Products