Hackers Broke In Within 9 Hours of This Linux Flaw Going Public #hacking #linux

A 10-year-old Linux security flaw is now being exploited. Within nine hours of its disclosure, attackers had gained root access to vulnerable test servers.

The flaw dates back to 2016, and it comes down to a single character, if you can believe it. Certain Alpine Linux servers use an asterisk to block password logins on accounts protected by digital keys. But submit a password longer than 256 characters, and the password checker can return that same asterisk as an error.

The server mistakes the error for a match and grants access. The attack requires specific settings, including password authentication being enabled and another account having a stored password.

Researchers confirmed the attack against a deliberately vulnerable server, not widespread production compromises. The fix is available. Affected servers need updating and the SSH service restarted.