News for Debian/Ubuntu users! (ALL Linux users, really...)

Lgbpop · 05-16-2008, 08:09 AM

I guess this was only a matter of time. Maybe it's also an indicator of how popular these Linux distros have become? Read on...

Quote:

Originally Posted by ComputerWorld.com

Tools circulate that crack Debian, Ubuntu keys

Newly found flaw yields tools that brute-force digital keys, certificates
By Gregg Keizer

May 15, 2008 (Computerworld) A recently disclosed vulnerability in widely used Linux distributions can be exploited by attackers to guess cryptographic keys, possibly leading to the forgery of digital signatures and theft of confidential information, a noted security researcher said today.

HD Moore, best known as the exploit researcher who created the Metasploit penetration testing framework, called the vulnerability in Debian and Ubuntu systems "ugly" and said it will be a big job for administrators to find every flawed key, then reissue them.

Full story:
http://www.computerworld.com/action/...icleId=9085980

lensman3 · 05-16-2008, 11:23 PM

The RISKS said this was in the Openssl and ssh encryption key generation problems. RISKS gave a range of affected builds. It had to do with one line a code that was pulled out because it gave a possible error in when memory leak code was used to test the builds. The bad builds could be compromised using ONLY 32K possible keys instead of billions(?). It is already fixed and if you regularly update your system you won't be hit. See "http://www.us-cert.gov/current/".

05-16-2008, 11:23 PM	#2 (permalink)
lensman3 Registered User Join Date: Oct 2007 Location: Littleton, Colorado USA Posts: 470 OS: xp 64 sp2 Fedora Core 8 (vmware xp core 8 x32) Minix	Re: News for Debian/Ubuntu users! (ALL Linux users, really...) The RISKS said this was in the Openssl and ssh encryption key generation problems. RISKS gave a range of affected builds. It had to do with one line a code that was pulled out because it gave a possible error in when memory leak code was used to test the builds. The bad builds could be compromised using ONLY 32K possible keys instead of billions(?). It is already fixed and if you regularly update your system you won't be hit. See "http://www.us-cert.gov/current/".