A flaw in OpenSSH on Alpine Linux and similar systems lets an attacker log in to locked accounts by typing a password that is far too long.
A security researcher has disclosed a flaw, nicknamed "*sshole," that lets attackers log in to some Linux accounts that are supposed to refuse passwords. The trick is simple: type an oversized password. The bug has existed since 2016 and was made public on November 5.
On Linux, an account can be locked against password logins by putting an asterisk (*) where its password fingerprint, called a hash, would normally be stored. An asterisk is not a valid hash, so no password should ever match it.
In 2016, OpenSSH, the common tool for remote server logins, was changed to stop attackers from guessing valid usernames by timing the server's replies. After that change, it checks a password even for accounts with no usable hash. On systems using a code library called musl, that check can return an asterisk when the password is longer than 256 bytes. OpenSSH then compares that asterisk with the stored asterisk, sees a match, and lets the person in.
Only OpenSSH servers on Linux systems that use musl are exposed, and only under certain authentication settings. That includes Alpine Linux, OpenWrt, Buildroot and Yocto. OpenWrt is often found on routers. Researcher Ozgun Kultekin warns that Alpine's official AWS and Azure cloud images have a default account named alpine that can run admin commands without a password. An attacker who gets in there could take full control of the machine.
Systems built on glibc, a different code library, are not vulnerable. That covers Debian, Ubuntu and Fedora. Systems that use PAM, another login method, are also safe from this attack. The flaw also does not let anyone get around real passwords on accounts that have a valid password hash.
A fix is available in OpenSSH 10.6p2. The alert box above lists the update command, a temporary workaround and how to check your logs. The main idea is to update first, and if that is not possible yet, turn off password logins on the server entirely.
Kultekin says the sign to look for is a successful password login on an account that should not allow one. If an account shows an asterisk in its password field but the logs show it logged in with a password, that could mean someone used this flaw.
Kultekin says he found the bug by using AI agents to run about 17,600 login tests with different settings, broken password hashes and oversized passwords. The material does not say whether attackers are already using the flaw, so checking logs is worth the time. Businesses that rely on a hosting provider or a router vendor may want to ask whether their products run Alpine or another musl-based system, and when a fixed version will arrive.
If you run Alpine or other musl-based Linux servers, update OpenSSH to 10.6p2 now and check your logs for password logins on locked accounts.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
