← Back to context

Comment by amluto

2 days ago

Wow, what a bug. I expect the exploit is literally as simple as trying to ssh in as a user with the password has ‘*’ in /etc/shadow and typing anything as the password.

To the extent that systems that are configured in the vulnerable manner exist in the wild, I’m surprised they weren’t exploited years ago by trivial ssh bots.

P.S. Wow, I’m reminded of just how awful traditional UNIX-y C APIs and code are.

P.P.S. The musl code in question is nuts. The API it implements is awful. Seriously, here’s the manpage:

https://man.archlinux.org/man/crypt.3.en

You can’t call this function correctly. sshd’s “fix” is basically to assume that a too-short return is an error return instead of a success return.

PAM is also awful, but this is worse.

9 comments

amluto

Reply
dpoloncsak  2 days ago

Maybe I'm misunderstanding, but u/tonnydourado pointed out on another thread https://news.ycombinator.com/item?id=50378228#50380029

"It starts with a bold claim: "ssh accounts that should not accept a password will accept any password between 256 and 1024 characters". But then it keeps adding qualifiers:

- sshd compiled with musl

- not using PAM

- password logins enabled

- at least one account with '*' as the password "hash"

- at least one OTHER account with a valid password

The conditions are all ANDed, miss a single one and you're fine."

This doesn't seem to be nearly as big as an issue as they're making it out to be

  • bombcar  2 days ago

    Alpine matches the first.

    Disabling PAM has been "generally good security advice" for decades; I remember suggestions to not use it in the 2000s.

    Password logins are often enabled, especially on multi-user and default setups.

    If alpine uses the * feature, it's going to be pretty common. Gentoo has it, as does Ubuntu.

    If password logins are enabled, you're almost guaranteed to have at least one user with a password (root on all my boxes has one, even if I never use it and it's random garbage).

    So the cheese lines up pretty well, this affects quite a bit.

    If password logins are enabled, someone almost certainly has a password.

    • dpoloncsak  2 days ago

      So it's essentially one of the 'recommended configurations'?

      I'm seeing people I generally trust in the scene memeing on twitter, while others are freaking out. Its hard for me to tell how fucked we are, I guess

      2 replies →

    • otterley  2 days ago

      Which distro has password authentication enabled by default? I haven’t seen that in years.

  • ferngodfather  2 days ago

    No, no don't let all of that distract you. We gotta hype this. This is the new SSH2SHELL dude. Have we registered the domain yet? I'm scheduled on Fox News tomorrow.

    • cmp-202  1 day ago

      They are going to be disappointed with SSH2SHELL it definitely isn't worth the hype. Using argument injection vulnerability created by a recent pull request that has been patched isn't exciting enough for a web site.