Password-disabled Linux accounts can still admit remote attackers

Daily Cyber News: Password-disabled Linux accounts can still admit remote attackers

Accounts intended to reject passwords can still admit remote attackers on certain Linux systems. The issue affects OpenSSH before 10.6p2 when musl is used without PAM and account settings rely on an asterisk to block password login. An oversized password can trigger a matching error value and be accepted.

Key context: The bypass doesn’t affect accounts with valid password hashes, and glibc-based or PAM-enabled systems aren’t affected.

Additional detail: Update affected systems to OpenSSH 10.6p2, disable S S H password authentication where possible and investigate suspicious logins involving accounts that shouldn’t accept passwords.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, linux, Password-disabled Linux, Password-disabled, accounts, still, admit, remote.