security

Decade-old vulnerability in OpenSSH is now fixed, so get a-patchin'

On certain Linux systems, an attacker could gain root access by entering a password longer than 256 bytes. The vulnerability, dubbed *sshole by Wakefield researcher Özgün Kültekin, who discovered it, can only be exploited in very specific conditions.

The flaw affects certain Linux systems using musl libc instead of the traditional GNU C library, and even then only those running OpenSSH's secure shell daemon without Pluggable Authentication Modules (PAM) and with password authentication enabled.

If those conditions are met, and at least one other account has a valid password hash, accounts that shouldn't accept passwords, such as root, key-only deployment users, and LDAP users, may be accessed by supplying a password between 257 and 1,024 characters.…