[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAOp4FwQVoV+Z6-Z1gtPDswZG1D4pdc+aF1FrzZc2huG6krKBJg@mail.gmail.com>
Date: Fri, 6 Nov 2026 23:28:29 +0400
From: Loganaden Velvindron <loganaden@...il.com>
To: musl@...ts.openwall.com
Subject: Re: OpenSSH password auth bypass analysis [was: Re:
Advisory for OpenSSH+musl users]
On Fri, 6 Nov 2026 at 23:25, Loganaden Velvindron <loganaden@...il.com> wrote:
>
> On Fri, 6 Nov 2026 at 22:55, Rich Felker <dalias@...c.org> wrote:
> >
> > On Thu, Nov 05, 2026 at 10:07:13AM -0500, Rich Felker wrote:
> > > Versions of OpenSSH prior to 10.6p2 using musl are affected by an
> > > authentication bypass when UsePAM=no and PasswordAuthentication=yes.
> > > Anyone who cannot immediately upgrade should edit /etc/ssh/sshd_config
> > > to set:
> > >
> > > PasswordAuthentication no
> > >
> > > and restart sshd after ensuring you have working pubkey access.
> > >
> > > Dropbear and other non-OpenSSH software using password-based logins is
> > > not affected. It is my position that this is not a bug in musl just an
> > > erroneous use by the caller. But the mechanism by which this happened
> > > is something we have been wanting to change for a while now, and it
> > > very likely will be changed in the upcoming release cycle.
> > >
> > > Details to follow soon.
> A lot of software has since fixed this and checked for null when
> calling crypt().
>
> A few software haven't been updated yet. e.g vsftp:
> https://github.com/cyberstormdotmu/vsftpd/commit/c96590f9a4056dfe73a01c8f02df5a3674ed9111
>
> I think I could submit a patch to remove this behaviour and return
> NULL for failure ?
PR submitted to vsftp : https://github.com/InfrastructureServices/vsftpd/pull/9
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
