SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (VPN)  >   OpenSSL Vendors:   OpenSSL.org
OpenSSL for Debian/Ubuntu Predictable RNG Lets Remote Users Determine Cryptographic Keys
SecurityTracker Alert ID:  1020017
SecurityTracker URL:  http://securitytracker.com/id/1020017
CVE Reference:   CVE-2008-0166   (Links to External Site)
Updated:  May 13 2008
Original Entry Date:  May 13 2008
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Debian 0.9.8c-1 and later, up to 0.9.8c-4etch3 (stable) and 0.9.8g-9 (unstable)
Description:   A vulnerability was reported in OpenSSL on Debian and Ubuntu Linux. A remote user can determine keys.

The OpenSSL random number generator creates keys in a predictable manner. A remote user can conduct guessing attacks to determine cryptographic keys.

Systems based on Debian Linux are affected, including Ubuntu Linux.

All cryptographic keys generated may be affected, including SSH keys, OpenVPN keys, DNSSEC keys, keys used in X.509 certificates, and session keys used in SSL/TLS connections.

GnuPG and GNUTLS keys are not affected.

Luciano Bello reported this vulnerability.

Impact:   A remote user can determine keys.
Solution:   Fixes are available for Debian and Ubuntu. Keys should be regenerated.

The Debian advisory is available at:

http://www.debian.org/security/2008/dsa-1571

The Ubuntu advisories are available at:

http://www.ubuntu.com/usn/usn-612-1
http://www.ubuntu.com/usn/usn-612-2

Cause:   Randomization error
Underlying OS:   Linux (Debian), Linux (Ubuntu)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 22 2008 (Asterisk Issues Advisory) OpenSSL for Debian/Ubuntu Predictable RNG Lets Remote Users Determine Cryptographic Keys
Asterisk has issued an advisory warning that keys generated using 'astgenkey' on Debian-based systems may be compromised.



 Source Message Contents

Date:  Tue, 13 May 2008 13:54:28 -0400
Subject:  OpenSSL


Debian/Ubuntu

CVE-2008-0166
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC