Meanwhile, the parties involved are playing a game of hot potato with who's fault.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
It works if you set an empty password for system users, which is the default on multiple distros. The bug is present, though not necessarily enabled, across Buildroot, Yocto, and Void Linux. OpenWRT uses Dropbear for authentication by default, but users can install OpenSSH instead.
The largest concern is by far Alpine, though, as it's pretty much the default choice for what could amount to millions of installs across Docker/Kubernetes/Proxmox containers and endless dependencies thereof, servers, cloud VMs, and embedded devices, among many others. Alpine comes with the requisite conditions set and password authentication enabled by default, which is why it needs immediate patching.
Broadly speaking, the vulnerability combination is: OpenSSH, musl, password authentication not explicitly disabled, not using PAM, and the one arbitrary user with a password set, using a SHA-512/256 hash. Patch your systems immediately, as per the project's advisory note . Meanwhile, the easiest mitigation is explicitly setting "PasswordAuthentication" to "no" in your OpenSSH configuration file and restarting the service.
Leaked private keys for eight CA certificates let any attacker impersonate any domain
Malicious VPN config files can let attackers run commands on Asus routers
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately#main
- https://www.tomshardware.com/membership
- Anthropic loosens Claude's game cloning ban
- Marvell to buy Lumentum in $115 billion all-stock deal
- This $79.98 TP-Link wireless router with Wi-Fi 7 tech is back down to its lowest-ever price
- Upgrade to an OLED display for only $269 at Walmart — Acer's 27-inch Nitro gaming monitor has a superfast 240Hz refresh rate and crisp WQHD resolution
- SpaceX's plan to build more data center compute than Google's entire lifetime capacity in just 1.5 years is possible, say analysts
Informational only. No financial advice. Do your own research.