Meanwhile, the parties involved are playing a game of hot potato with who's fault.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
It works if you set an empty password for system users, which is the default on multiple distros. The bug is present, though not necessarily enabled, across Buildroot, Yocto, and Void Linux. OpenWRT uses Dropbear for authentication by default, but users can install OpenSSH instead.
The largest concern is by far Alpine, though, as it's pretty much the default choice for what could amount to millions of installs across Docker/Kubernetes/Proxmox containers and endless dependencies thereof, servers, cloud VMs, and embedded devices, among many others. Alpine comes with the requisite conditions set and password authentication enabled by default, which is why it needs immediate patching.
Broadly speaking, the vulnerability combination is: OpenSSH, musl, password authentication not explicitly disabled, not using PAM, and the one arbitrary user with a password set, using a SHA-512/256 hash. Patch your systems immediately, as per the project's advisory note . Meanwhile, the easiest mitigation is explicitly setting "PasswordAuthentication" to "no" in your OpenSSH configuration file and restarting the service.
Leaked private keys for eight CA certificates let any attacker impersonate any domain
Malicious VPN config files can let attackers run commands on Asus routers
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately#main
- https://www.tomshardware.com/membership
- Thin, Light and Built for Everything: NVIDIA RTX Spark Windows Laptops Gain New Models, Agent Tools and Games
- Rogue AI tasked with renumbering pages accidentally deletes law professor's entire syllabus, one year of lecture notes
- Grab a huge 44% saving on a 4K 43-inch Samsung smart monitor, now under $280
- Nintendo Switch 2 sales dropped by 41% from last year due to console's price increase
- Intel leaker claims Nova Lake desktop chips have 5.1 GHz clock limit beyond 90°C
Informational only. No financial advice. Do your own research.