Alpine Linux Docker images ship a root account with no password

guest · May 8, 2019

Alpine Linux Docker images ship a root account with no password
Attackers can authenticate on vulnerable systems using the root user and no password
May 8, 2019
https://www.zdnet.com/article/alpine-linux-docker-images-ship-a-root-account-with-no-password/

Alpine Linux Docker images distributed via the official Docker Hub portal for the past three years and a half have been using a blank (NULL) password for the root account, security researchers from Cisco have revealed today.
All Alpine Linux Docker images, since v3.3, are impacted, Cisco Talos said today in a security alert.

Servers and workstations that have been provisioned/installed from Glider Labs' Alpine Linux Docker images are now at risk of being hijacked by attackers who can authenticate using the root user and no password.

While new Alpine Linux images have been released on Docker Hub, existing systems should be modified to either disable the root account or, at least, set a custom password.
For security researchers and system administrators tracking vulnerabilities via CVE identifiers, this flaw's identifier is CVE-2019-5021.
Click to expand...

guest · May 21, 2019

194 of The Top 1000 Docker Containers Don’t Have Root Passwords
May 21, 2019
https://www.bleepingcomputer.com/ne...-docker-containers-don-t-have-root-passwords/

Cisco Talos' discovery that the Alpine Linux distribution Docker image came with a blank root password (CVE-2019-5021) led to the discovery that 194 of the top 1000 most popular Docker containers also have no root passwords.

The Docker containers with no root passwords were found by Kenna Security's principal security engineer Jerry Gamblin after he decided to scan the 1000 most popular containers with the end goal of finding out if there were other passwordless containers.

"In all, on Saturday, May 18th, when I ran the script, 194 of the most popular containers had nulled root passwords. Some of the most known names of that list being govuk/governmentpaas, hashicorp, microsoft, monsanto, and mesosphere. kylemanna/openvpn is the most popular container on the list and it has over 10,000,000 pulls," stated the researcher in his analysis.
Configuration-based security concerns
Allowing users to login as root without the need of a password drastically increases the possibility of exposing the system to a security breach.
"Deploying containers that allow users to authenticate as root should be avoided at all costs, because authenticating as root is already outside the scope of ‘best practices’ for secure containers or generally in system," said Gamblin.
Click to expand...

Log in or Sign up

Alpine Linux Docker images ship a root account with no password

guest Guest

guest Guest

Log in or Sign up

Alpine Linux Docker images ship a root account with no password

guest Guest

guest Guest

Useful Searches