Alpine Linux Docker images have NULL for root password
1–10 of 203 posts
Re: Alpine Linux Docker images have NULL for root password
#2Hmm? Per the Date Entry Created this was reported months ago (EDIT: I can't read), although the linked report (https://talosintelligence.com/vulnerability_reports/TALOS-20...) was posted today
Re: Alpine Linux Docker images have NULL for root password
#3Hmm? Per the Date Entry Created this was reported months ago (EDIT: I can't read), although the linked report ( https://talosintelligence.com/vulnerability_reports/TALOS-20... ) was posted today
> Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Re: Alpine Linux Docker images have NULL for root password
#4Hmm? Per the Date Entry Created this was reported months ago (EDIT: I can't read), although the linked report ( https://talosintelligence.com/vulnerability_reports/TALOS-20... ) was posted today
[deleted]
Re: Alpine Linux Docker images have NULL for root password
#5Note the conditional:
"systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user"
So if you're not using a container running ssh/etc, it doesn't affect you.
Serious question: what's the use of PAM in a docker image that's vulnerable here?
Re: Alpine Linux Docker images have NULL for root password
#6Is this a risk out of the box?
$ docker run -it -u guest alpine
/ $ su
su: must be suid to work properly
/ $ login
login: must be suid to work properly
/ $ find / -perm /4000 -print
find: /root: Permission denied
find: /proc/tty/driver: Permission denied
/ $Re: Alpine Linux Docker images have NULL for root password
#7I believe it's public on their GitHub since 5 Aug 2018. https://github.com/gliderlabs/docker-alpine/issues/430
> 2019-03-01 - It was discovered that this issue was also reported and made public in their Github prior to our report, but was not flagged as a security issue and thus remained unresolved until it was rediscovered and reported by Cisco.
https://talosintelligence.com/vulnerability_reports/TALOS-20...
Re: Alpine Linux Docker images have NULL for root password
#8Seriously, if an attacker is in a position to exploit this, hasn’t everything already failed?
Or to put another way, under what condition is this actually helpful defense in depth?
Nothing should be able to login locally to an Alpine container. All authentication should be public key based to begin with.
What would the root password be if not null?
Re: Alpine Linux Docker images have NULL for root password
#9Seriously, if an attacker is in a position to exploit this, hasn’t everything already failed? Or to put another way, under what condition is this actually helpful defense in depth? Nothing should be able to login locally to an Alpine container. All authentication should be public key based to begin with. What would the root password be if not null?
> What would the root password be if not null?
Deactivated, allowing no root login.
EDIT:
> Seriously, if an attacker is in a position to exploit this, hasn’t everything already failed?
Not necessarily I think. Something might support PAM auth (by accident or intentionally) and it wouldn't allow anything if no/only accounts with strong passwords can be logged into, but obviously breaks once root is available for login.
Re: Alpine Linux Docker images have NULL for root password
#10I believe it's public on their GitHub since 5 Aug 2018. https://github.com/gliderlabs/docker-alpine/issues/430 > 2019-03-01 - It was discovered that this issue was also reported and made public in their Github prior to our report, but was not flagged as a security issue and thus remained unresolved until it was rediscovered and reported by Cisco. https://talosintelligence.com/vulnerability_reports/TALOS-20...
> https://github.com/gliderlabs/docker-alpine/issues/430
That issue is claimed to have been fixed, with a reference to a commit of the updated images, says issue 430 is a security issue and closed, but no link to the actual fix.
Word to the wise folks: If you are fixing bugs by posting binaries, it's a good idea to include a reference to the git hash of the actual fixes you've built those binaries with.