Vulnerability Leaves Container Images Without Passwords

A old vulnerability in Alpine Linux containers has spread and propagated to as much as 20% of the containers on the Docker Store.

Nearly one in five of the most popular containers available on the Docker store have no password for root access. Thats the finding of researcher Jerry Gamblin, building on work by researchers at Cisco Talos. The result could easily be hundreds of thousands of containers deployed with no functional password at all.
The finding is important because containers, most frequently with Docker as the container manager, are becoming popular for deploying virtualized applications (as opposed to completed virtualized servers deployed with products like VMware or Microsoft Hyper-V). As
Docker puts it
, A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries, and settings.
In order to save time, developers will often put a container image into a repository for reuse, or theyll look at a public repository, like GitHub or the
Docker Store
, to find containers built by others that they can download and use. If those publicly available containers have vulnerabilities, they can quickly spread across the Internet.
According to the original
Cisco Talos report
, the vulnerability began with null passwords for the root user in Docker images for Alpine Linux, a lightweight, container-specific Linux distribution very popular in container development.
The vulnerability, now designated CVE-2019-5021, was first discovered in 2015 and patched — but then eight days later someone replaced a patched file with another file that enabled the vulnerability. A series of testing errors allowed the vulnerable files to be retained and distributed until May of this year. The original Alpine Linux images have been repatched, but Gamblin found that many containers remain with the vulnerability intact.
Gamblin
, who is principal security engineer at Kenna Security, says the need for development speed — a need that has made containers a more popular deployment option — also means best practices arent always followed.
I think were at the point in containers where theyre becoming more useful locally and in small company situations, and youre seeing fewer best practices used, he says. Its developers, its system admins, and just people testing software and running it on their local machines that blow by best practices in the name of speed.
The good news for developers and security professionals is that the technology issue around this vulnerability has been solved. Its now up to processes and practices to ensure secure containers are pulled from repositories and deployed.
Gamblin says he sees this as an issue security teams should be aware of but not lose sleep over. Its a weakness, but its not a structural weakness, he says.
As he pointed out in a
blog post
he wrote about the vulnerability: Deploying containers that allow users to authenticate as root should be avoided at all costs, because authenticating as root is already outside the scope of best practices for secure containers or generally in system.
Related Content:
2.3B Files Currently Exposed via Online Storage
Incident Response: 3 Easy Traps & How to Avoid Them
6 Serverless and Containerization Trends CISOs Should Track
Docker Vulnerability Opens Servers to Container Code

Last News
▸ FBI informs bank executives of DDoS attack campaign ◂ Discovered: 26/12/2024 Category: security	▸ Police frustrated by backlog in decrypting Apple iPhones. ◂ Discovered: 26/12/2024 Category: security	▸ Black Hat USA 2013 covers SIM card, Femtocell hacking talks. ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Vulnerability Leaves Container Images Without Passwords