Some Alpine Linux configurations—and potentially devices running other distributions—are vulnerable to a decade-old flaw that can allow an attacker to log in without a password. The issue arises from the interaction between OpenSSH, the software that provides SSH connections, and musl, a lightweight alternative to the standard GNU C Library (glibc) used by Alpine Linux. The vulnerability affects systems where OpenSSH uses musl without the Pluggable Authentication Module (PAM) framework.
Alpine is a lightweight and widely used Linux distribution, but other platforms could also be affected if they use the same configuration.
One connection is enough
Successful exploitation requires two additional conditions. First, the system must have at least one user account that can be accessed with a password hashed using SHA-256 or SHA-512. The target account must then be configured without a password by placing an asterisk (*) in the password field of /etc/shadow, the Linux file that stores password hashes.
Passwordless accounts are typically used with certificate-based authentication, and this configuration is common for certain types of accounts.
When all of these conditions are present, an attacker who can reach the SSH port can log in without knowing the password.
“An attacker with access to the SSH port can log in without knowing the password,” Alpine administrators said on Thursday. “Connect once and it works every time, no need to retry.”
To access an account without a password, an attacker can enter more than 256 characters in the password field.
Why the password hash matters
Security company Check Point said that using SHA-256 or SHA-512 is “important because sshd borrows that account’s salt; without it, the attack will fail.” The company’s researchers also found in their tests that the account had to be active, rather than merely containing a password hash.
Check Point further reported that the default PermitRootLogin setting, which disallows password-based root logins, keeps the root account protected. However, any accessible account with doas or sudo privileges could potentially be used to gain root access.
Source: arstechnica.com
