|
|
OpenSSL flaw in Debian Linux discovered
Author: Gareth HalfacreePublished: 14th May 2008
Floating gnus will be the least of your worries if you don't patch your Debian-based OpenSSL install before the crackers find you.
The Debian distribution – upon which popular desktop Linux distributions including Ubuntu, Kubuntu, and Damn Small Linux are built – has been distributing a version of the OpenSSL encryption package with a random number generator that turns out not be quite as random as you might like.
Computer encryption relies on the generation of pseudo-random numbers. While a truly random number generator isn't possible without recourse to an external source of entropy, by salting the RNG with user-provided input such as a recent keystrokes, mouse usage and network traffic data it's possible to get darn close. If the random number generator produces a predictable output, an attacker can decrypt supposedly secure data by simply working out what numbers were fed to the encryption algorithm.
The issue stems from a bug fix to the OpenSSL package, which was first introduced back in 2006 in version 0.9.8c-1. This version, and all subsequent versions, rely on a random number generator which produces guessable results – a big no-no for cryptography purposes. Debian-based systems that use the Secure SHell (SSH), OpenVPN, DNSSEC, and users of X.509 certificates that have been generated on such systems are compromised by the flaw, as are DSA signing keys as used by the GNU Privacy Guard package.
The flaw in the OpenSSL package is specific to the version distributed with Debian and Debian-based Linux distributions – other versions including Fedora, Slackware, and Gentoo and their variants are not affected.
The issue, along with a few other flaws, is resolved in the latest version of the Debian OpenSSL implementation, 0.9.8c-4etch3. If you're running a vulnerable version – and I know I am – then it would be a very good idea to upgrade now, and regenerate cryptographic keys once you've got it installed.
Any Windows users want to point and laugh now the shoe is on the other foot, or perhaps you're an AIX user shaking your head at the antics of these Johnny-come-latelys? Share your thoughts over in the forums.
Related articles on bit-tech.net
Comments (24)Stats: 0.137 seconds
hahaha. My dreams have come true, the day something wrong comes to linux, no matter how small it was.... Sorry, all childish now.
At least in the light of this, its been sorted out relativley quickly, which is a good sign for any OS.
Sam
Maybe I was too sarcastic (is there such a thing as too sarcastic?).
btw, slackware strawberry Cheesecake :D
This bug is also already fixed, so it' a non-issue. I don't have the time to redo my keys right now, so al hackers, go ahead ;)
If it was a Windows bug, it wouldn't have been patched until the first Tuesday of NEXT month at the earliest!
I just updated my ubuntu fileserver (ala Glider's superb server guide) to 8.04LTS and it fired up a warning message telling me about the security hole. Not sure if it sorts it automatically or whether I need to flex my typing skills on the command line :)
Because as soon as it was caught it was fixed, wouldn't be the first time a large whole has been found in windows after a few years and it still takes at least a month for the fix.
uh... perhaps I missed your point.. but my point was that, as Ubuntu is massively popular (especially with newbies like myself), you'll get a larger amount of people with this flaw unpatched in their system (as opposed to say people that run a distro that isn't as popular).. which is too bad.
Well, since public/private key pairs can be used for passwordless SSH, well... passwords :D