Patch OpenSSH Now to Stop Long-Password Login Bypass

A newly disclosed OpenSSH security flaw can let an attacker sign in to certain Linux systems without knowing the account password. The issue could matter to households and small offices running affected Linux servers, OpenWrt devices or other equipment with SSH exposed to a network.

What happened

The high-severity vulnerability affects the OpenSSH server on certain Linux distributions that use the musl C library without Pluggable Authentication Modules, or PAM. According to SecurityWeek, an attacker can exploit the flaw by submitting a password containing between 257 and 1,024 characters.

OpenSSH released version 10.6p2 to address the problem. The weakness is not within the OpenSSH server itself, according to an OpenSSH developer cited by SecurityWeek, but attackers can still reach it through the server’s login process.

The report says an attacker who can connect to an affected SSH port may need only one attempt. No exploitation had been reported when the source was published, but technical details were public and security researchers expected attackers to begin scanning for vulnerable systems quickly.

Who is affected

A system is affected only when several conditions are present. It must use musl libc, run OpenSSH without PAM, allow password authentication and contain an account whose password field is marked with an asterisk. It must also have at least one local account using a SHA-256 or SHA-512 password hash in the formats described by Alpine Linux.

SecurityWeek names Alpine Linux, OpenWrt, Buildroot and Yocto among the Linux distributions where the underlying conditions may occur. That does not mean every device using one of those systems is vulnerable.

Alpine Linux found the issue in releases 3.21 through 3.24 and its edge release. Older releases from 3.16 through 3.20 were also affected but no longer receive regular updates. Specific affected OpenWrt versions, router models and other consumer products have not been disclosed in the source.

What to do now

1. Identify devices that accept SSH connections. Check Linux computers, home servers and OpenWrt devices you administer. If you do not use SSH or do not know whether a device offers it, review its administration page or ask its manufacturer.

2. Install the latest available security update. Open the device’s system or firmware update page and apply the newest supported release. OpenSSH 10.6p2 contains the fix, according to SecurityWeek, but packaged versions may use different numbering.

3. Restart the SSH service after updating. Alpine Linux specifically advised restarting sshd so the corrected software replaces the currently running process. Reboot the device if its update instructions require that instead.

4. Turn off password-based SSH login if you cannot patch immediately. Alpine Linux identified this as a temporary mitigation. Do this only if you already have another tested way to sign in, such as SSH keys, so you do not lock yourself out.

5. Do not expose SSH directly to the internet unless necessary. Check your router for port-forwarding rules that send port 22 to an internal device and remove any rule you no longer need. CyberSec24’s home network security guide explains additional ways to reduce unnecessary access.

6. Replace unsupported installations. If a device runs an Alpine release that no longer receives regular updates, move it to a supported release or contact the vendor about an updated firmware image.