SSHhole lets anyone log into some OpenSSH boxes with a 257-character password

A researcher has published a bug nicknamed SSHhole that lets someone log into an OpenSSH account by typing any string longer than 256 characters. The content doesn't matter. According to the Risky Business write-up, you get root as long as you type more than 256.

It works against accounts with the password disabled or set up for key-only logins, which is the configuration most operators would call the safe one.

The saving grace is that it isn't universal. It only affects OpenSSH on Linux distributions that use musl as the standard C library: Alpine Linux, OpenWRT, BuildRoot and Yocto. Ozgun Kultekin, a security researcher at Wakefield, found it.

Alpine is common in cloud environments, and OpenWRT is router firmware used by hobbyists and commercial router makers. The newsletter says the bug affects all OpenSSH musl versions released over the past decade. OpenSSH shipped patches on Thursday, a day after it learned of the issue. Alpine has released security updates too.

The routers and IoT gear running OpenWRT are the part we'd worry about. Nobody has said how many devices are exposed, and firmware updates on that kit tend to sit uninstalled for years.

If you run Alpine or OpenWRT anywhere, check the OpenSSH package version first and update it. Then look at whether anything on those hosts accepts key-only logins from an untrusted network.