Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
摘要
一项存在约十年的OpenSSH与musl交互漏洞影响部分Alpine Linux配置，攻击者可无密码登录设备。利用需满足：系统至少有一个使用SHA256或SHA512哈希密码的账户，且目标账户在/etc/shadow密码字段中配置为“*”以实现无密码。使用musl的OpenSSH还须未启用PAM。其他采用相同配置的平台也可能受影响。
Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into devices with no password.
The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library that, unlike most other Linux distributions, is used in Alpine. Further, OpenSSH using musl (pronounced muscle) must not use PAM (pluggable authentication modules), a framework that handles user authentication and account-access checks. Alpine is a lightweight, widely used Linux distribution. Other platforms may be affected if they use the same configurations.
One connection, works every time, needs no retries
There are two other conditions necessary for successful exploitation. First, a system must have at least one user account that’s accessible using a password that is hashed using the SHA256 or SHA512 functions. Second, the target system account must be configured to be passwordless, by way of specifying a "*" in the password field in /etc/shadow, the Linux file where password hashes are stored. Passwordless accounts are commonly used for accounts that use certificate-based authentication. This setting is common for certain types of accounts.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧