Meanwhile, the parties involved are playing a game of hot potato with who's fault.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
It works if you set an empty password for system users, which is the default on multiple distros. The bug is present, though not necessarily enabled, across Buildroot, Yocto, and Void Linux. OpenWRT uses Dropbear for authentication by default, but users can install OpenSSH instead.
The largest concern is by far Alpine, though, as it's pretty much the default choice for what could amount to millions of installs across Docker/Kubernetes/Proxmox containers and endless dependencies thereof, servers, cloud VMs, and embedded devices, among many others. Alpine comes with the requisite conditions set and password authentication enabled by default, which is why it needs immediate patching.
Broadly speaking, the vulnerability combination is: OpenSSH, musl, password authentication not explicitly disabled, not using PAM, and the one arbitrary user with a password set, using a SHA-512/256 hash. Patch your systems immediately, as per the project's advisory note . Meanwhile, the easiest mitigation is explicitly setting "PasswordAuthentication" to "no" in your OpenSSH configuration file and restarting the service.
Leaked private keys for eight CA certificates let any attacker impersonate any domain
Malicious VPN config files can let attackers run commands on Asus routers
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately#main
- https://www.tomshardware.com/membership
- This $79.98 TP-Link wireless router with Wi-Fi 7 tech is back down to its lowest-ever price
- Nintendo’s latest Zelda remake already circulating online as a Switch 2 ROM
- T-Mobile launches $90 5 Gbps fiber internet plan
- Cloud Deployment Incoming: ‘Call of Duty: Modern Warfare 4’ Arrives on GeForce NOW
- Save 26% on this 142-piece toolkit for your PC repairs and hobbyist projects, now under $28
Informational only. No financial advice. Do your own research.