Watch Desk posted an update
The Register reports that a vulnerability in certain OpenSSH setups could let an attacker gain root access by submitting an unusually long password. The flaw affects specific musl-based Linux systems, and only when several configuration conditions are met.
Why it mattersThe report says OpenSSH 10.6p2 or newer fixes the issue. If an affected system cannot be updated, its suggested workaround is to disable password authentication and restart the SSH daemon. The researcher who found the flaw reported no indication that vulnerable systems have been exploited. If you administer musl-based Linux machines, check whether the affected configuration applies before deciding what to patch or disable.
Discuss: For systems that cannot be patched promptly, is disabling password authentication a practical stopgap, or does it create too much disruption?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.