A flaw hidden in OpenSSH for about a decade lets attackers into some locked Linux accounts with an oversized password. Check whether your servers are affected.
A flaw that has sat in OpenSSH code for about a decade lets attackers log in to some locked Linux accounts by typing a password that is far too long. It is nicknamed *sshole, short for "SSH hole."
OpenSSH is the tool administrators use to log in to servers from a distance. The problem appears when it runs on musl, a basic building block used by Alpine Linux and some other Linux systems. Some accounts are set to refuse password logins. On affected systems, an oversized password gets an attacker in anyway.
A commenter on the Schneier on Security post explains the name. Old Unix password files put an asterisk in the password field to mark an account as off limits for login. That detail is part of why the flaw works.
Only Alpine Linux and other musl-based systems are named. Many websites and apps run on Linux servers, so it is worth asking your IT provider or host whether yours are among them. If they are not, the report does not describe them as affected.
The source text is cut off before it says how long a password must be to trigger the flaw. It also does not say whether attackers are using it now, or whether fixes are already out. Those answers will decide how urgent this is for each system.
The steps in the alert box above cover what to ask and check. The main idea is that turning off password login should not be treated as proof an account is safe.
Ask your IT provider whether any of your servers run Alpine Linux or another musl-based system, and whether they have patched.
Scam texts posing as E-ZPass say you owe an unpaid toll and push you to tap a link. Tapping or paying could put your card details in criminal hands.
Read more: Fake E-ZPass toll texts are going around. Here is how to spot themA tech writer ran a Jellyfin movie server on a Galaxy S8 and streamed films to an iPhone with no internet at all. Here is what worked and what did not.
Read more: An old Samsung phone can run your own movie server, even offlineBreach Secure Now has launched a connector that lets people ask ChatGPT, Claude or Microsoft Copilot about their security training data, and it is available now.
Read more: Security training data can now be asked about in ChatGPT or Claude
