Researcher Ozgun Kultekin reveals OpenSSH flaw unlocking password-disabled Linux accounts
The gist
Security researcher Ozgun Kultekin disclosed an OpenSSH flaw letting long passwords unlock password-disabled accounts on musl systems.
OpenSSH 10.6p2 fixes it; Alpine cloud images with a default account are most exposed.
How it unfolded
- 1980Bill Joy put a `*` in the password field for an account called `daemon` in /etc/passwd; since a `*` is not a hash, no password can match it.
- Aug 2012musl changed crypt() to return a single character, `*`, instead of NULL on failure, and added sha256/sha512 crypt with a 256-byte key cap.
- 2013The libc-alpha list and a Debian bug (714219) discussed handling crypt() failure, and a musl maintainer defended the asterisk scheme as the best available compromise.
Key terms
- OpenSSH
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
- musl
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- PAM
- A mechanism that integrates multiple low-level authentication schemes into a high-level API, letting programs authenticate independently of the underlying scheme.
Source: Wikipedia