Attackers hit OpenSSH 'SSHole' flaw within hours of disclosure
A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.
A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.
What to do
Treat this as urgent. Check whether you run the affected product, apply the vendor fix, and review logs for signs of compromise from before the patch.
Original reporting: The Hacker News
Original reporting: The Hacker News
Discussion
0 commentsSign in to join the discussion.