Some implementations of secure shell (SSH), one of Linux's most trusted and secure connection protocols, have been found vulnerable to the most peculiarly simple methods of bypass: spamming characters.

On some distros, simply type 257–1,024 characters and you get access to the root (admin) login. Thankfully, the list of vulnerable distros is quite small and niche, and OpenSSH has already issued a workaround/fix.

In some new release notes, OpenSSH explains that "this release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled."

"Sshd(8): avoid password authentication bypass that is exploitable through sshd(8) that affects some Linux systems when built and run with PAM support disabled. We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there."

SSH itself is a longstanding and ubiquitous networking protocol that anyone who has dabbled even lightly in Linux networking projects will be familiar with. It's what manages comms between Linux machines. If you've ever used a Raspberry Pi remotely, for instance, you'll likely have logged into it using SSH. Same goes for a NAS. It's also used by devs to push/pull/manage GitHub files.

Thankfully, it's not SSH in general that has the problem but just a small number of distros that use SSH.

According to an explanation on sshhole.com—a website written by Ozgun Kultekin who discovered the bug—this is an issue with "musl Linux."

This refers to any Linux OS that uses the musl C library rather than the standard Glib C library, which is a fancier way of saying: not many distros.

Source link