CVE-2016-6210

OpenSSH released an emergency critical update (version 10.6p2) to address a vulnerability that allows attackers to bypass SSH authentication on Alpine Linux systems by using long passwords (257–1,024 bytes) to log in to passwordless accounts. The flaw affects systems running OpenSSH without PAM, where password authentication is enabled and at least one local account has a password hash. The vulnerability stems from interaction between OpenSSH and musl C library, and impacts Alpine Linux, OpenWrt (if OpenSSH is installed), Buildroot, and Yocto. No CVE has been assigned yet, and no active exploitation has been reported.

A vulnerability in OpenSSH on musl-based Linux systems, such as Alpine Linux, OpenWrt, Buildroot, and Yocto, allows attackers to bypass password authentication by submitting an oversized password. The flaw, dubbed 'sshole', exploits how OpenSSH handles password verification errors when accounts are configured with an asterisk (*) in /etc/shadow to disable password login. When an oversized password is submitted, the musl crypt() function returns *, matching the stored * and resulting in unauthorized access. The issue affects systems with SSH password authentication enabled, PAM disabled, and at least one account with * password hash. It has been patched in OpenSSH 10.6p2.