Making Tech Headlines · Page 1
OpenSSH's Locked Door May Open for a Particularly Long Password
· New York time
A newly disclosed OpenSSH flaw can allow attackers to access some password-disabled accounts on musl-based Linux systems by submitting a password longer than 256 bytes. Researcher Ozgun Kultekin disclosed the vulnerability, nicknamed *sshole, which affects certain Alpine configurations and potentially other distributions. The reporting says the flaw has existed since 2016. Password-disabled accounts are intended to reject password authentication, so the problem turns a basic security assumption into an unusually long typing exercise. The affected software is used for remote access, making the finding relevant to administrators responsible for Linux devices and servers. The flaw's nickname has at least accomplished something that many security bulletins struggle to do: it gives a technical warning a name people might actually remember. The patch notice does not need a celebrity spokesperson when its title can make an administrator pause halfway through an inbox. The affected configurations still matter, however. This is not a claim that every Linux machine will accept a long password, but a reason for operators of the relevant systems to check their exposure and available updates. For a decade, a setting meant to close one entrance may have left a peculiar exception. The password field apparently believed that if a visitor wrote enough, the rules deserved a sequel.
Read this story in the full newspaper →Satire. Not factual reporting. Read the original reporting from the linked publishers.