exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Secunia Security Advisory 30220

Secunia Security Advisory 30220
Posted May 13, 2008
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Debian has issued an update for OpenSSL. This fixes some vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system, and a security issue, which can lead to weak cryptographic key material.

tags | advisory, denial of service, vulnerability
systems | linux, debian
SHA-256 | 19148622871388bcb872aa232adb8fb844a27eb715706a8d437ebe23f54a7aea

Secunia Security Advisory 30220

Change Mirror Download
----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

The Public Beta has ended. Thanks to all that participated.

Learn more:
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
Debian OpenSSL Predictable Random Number Generator and Update

SECUNIA ADVISORY ID:
SA30220

VERIFY ADVISORY:
http://secunia.com/advisories/30220/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, DoS, System access

WHERE:
>From remote

OPERATING SYSTEM:
Debian GNU/Linux 4.0
http://secunia.com/product/13844/
Debian GNU/Linux unstable alias sid
http://secunia.com/product/530/

DESCRIPTION:
Debian has issued an update for OpenSSL. This fixes some
vulnerabilities, which can be exploited by malicious people to cause
a DoS (Denial of Service) and potentially compromise a vulnerable
system, and a security issue, which can lead to weak cryptographic
key material.

1) The security issue is caused due to the random number generator in
Debian's openssl package being predictable. This may lead to weak
cryptographic key material being generated e.g. for SSH keys, OpenVPN
keys, DNSSEC keys, and key material for use in X.509 certificates and
session keys used in SSL/TLS connections.

The security issue is reported in Debian's OpenSSL packages starting
with 0.9.8c-1 (uploaded to the unstable distribution on 2006-09-17)
and affects all keys generated with an affected package.

2) An unspecified error within the DTLS implementation can be
exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a vulnerable system.

For more information:
SA25878

SOLUTION:
Apply updated packages and recreate all cryptographic key material
(see vendor advisory for more information).

-- Debian GNU/Linux 4.0 alias etch --

Source archives:

http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3.dsc
Size/MD5 checksum: 1099 5e60a893c9c3258669845b0a56d9d9d6
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c.orig.tar.gz
Size/MD5 checksum: 3313857 78454bec556bcb4c45129428a766c886
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3.diff.gz
Size/MD5 checksum: 55320 f0e457d6459255da86f388dcf695ee20

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_alpha.deb
Size/MD5 checksum: 1025954 d82f535b49f8c56aa2135f2fa52e7059
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_alpha.deb
Size/MD5 checksum: 4558230 399adb0f2c7faa51065d4977a7f3b3c4
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_alpha.deb
Size/MD5 checksum: 2620892 0e5efdec0a912c5ae56bb7c5d5d896c6
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_alpha.deb
Size/MD5 checksum: 2561650 affe364ebcabc2aa33ae8b8c3f797b5e
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_alpha.udeb
Size/MD5 checksum: 677172 5228d266c1fc742181239019dbad4c42

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_amd64.deb
Size/MD5 checksum: 1654902 d8ad8dc51449cf6db938d2675789ab25
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_amd64.deb
Size/MD5 checksum: 891102 2e97e35c44308a59857d2e640ddf141a
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_amd64.deb
Size/MD5 checksum: 992248 82193ea11b0bc08c74a775039b855a05
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_amd64.deb
Size/MD5 checksum: 2178610 fb7c53e5f157c43753db31885ff68420
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_amd64.udeb
Size/MD5 checksum: 580250 7fb3d7fee129cc9a4fb21f5c471dfbab

arm architecture (ARM)

http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_arm.deb
Size/MD5 checksum: 1537440 c5ab48e9bde49ba32648fb581b90ba18
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_arm.udeb
Size/MD5 checksum: 516576 84385b137c731de3b86824c17affa9f3
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_arm.deb
Size/MD5 checksum: 2049882 7ed60840eb3e6b26c6856dcaf5776b0c
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_arm.deb
Size/MD5 checksum: 1011698 abfa887593089ac0f1cd4e31154897ee
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_arm.deb
Size/MD5 checksum: 805912 a605625ea107252e9aebbc77902a63ed

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_hppa.deb
Size/MD5 checksum: 1585900 2cbe55764db351dc6c3c2d622aa90caf
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_hppa.deb
Size/MD5 checksum: 2248328 664fb0992b786ce067a7d878056fc191
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_hppa.deb
Size/MD5 checksum: 1030782 21f445c541d5e5b7c16de1db9ee9d681
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_hppa.deb
Size/MD5 checksum: 945144 c1092f3bb94d920d0beaa372c9cab04e
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_hppa.udeb
Size/MD5 checksum: 631132 76339119275786b5e80a7a1b4cd26b71

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_i386.deb
Size/MD5 checksum: 2086512 eeef437fb87ad6687cd953d5951aa472
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_i386.deb
Size/MD5 checksum: 5584696 6d364557c9d392bb90706e049860be66
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_i386.deb
Size/MD5 checksum: 1000832 ed5668305f1e4b4e4a22fbd24514c758
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_i386.udeb
Size/MD5 checksum: 554676 dbad0172c990359282884bac1d141034
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_i386.deb
Size/MD5 checksum: 2717086 361fde071d18ccf93338134357ab1a61

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_ia64.udeb
Size/MD5 checksum: 801748 05b29fc674311bd31fe945036a08abd5
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_ia64.deb
Size/MD5 checksum: 1192192 56be85aceb4e79e45f39c4546bfecf4f
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_ia64.deb
Size/MD5 checksum: 2593418 f9edaea0a86c1a1cea391f890d7ee70f
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_ia64.deb
Size/MD5 checksum: 1569418 4b2cb04d13efabdddddbd0f6d3cefd9b
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_ia64.deb
Size/MD5 checksum: 1071156 e1f487c4310ad526c071f7483de4cd1a

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_mips.deb
Size/MD5 checksum: 1003816 f895a8bc714e9c373ee80f736b5af00b
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_mips.deb
Size/MD5 checksum: 2262266 004484e816d4fe5ff03fe6d7df38d7b7
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_mips.deb
Size/MD5 checksum: 1692606 e8273f5d123f892a81a155f14ba19b50
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_mips.deb
Size/MD5 checksum: 875558 44074bce1cde4281c5abcf45817f429d
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_mips.udeb
Size/MD5 checksum: 580130 b6b810d1c39164747e3ebc9df4903974

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_mipsel.udeb
Size/MD5 checksum: 566168 97963ca9b6ada94445fb25b3126655e9
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_mipsel.deb
Size/MD5 checksum: 992712 41c2bbe984553d693f21c3ec349ea465
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_mipsel.deb
Size/MD5 checksum: 2255558 3c63936cd511975291b4230bef1a2e3b
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_mipsel.deb
Size/MD5 checksum: 860506 d580fbeed6efd734245ea7a7bed225bb
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_mipsel.deb
Size/MD5 checksum: 1649300 3315d1406f995f5b6d2a4f958976a794

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_powerpc.deb
Size/MD5 checksum: 1002022 b2749639425c3a8ac493e072cfffb358
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_powerpc.deb
Size/MD5 checksum: 895460 e15fbbbbcfe17e82bacc07f6febd9707
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_powerpc.udeb
Size/MD5 checksum: 585320 61488ea7f54b55a21f7147fe5bc3b0f0
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_powerpc.deb
Size/MD5 checksum: 1728384 539ee1a3fe7d9b89034ebfe3c1091b6f
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_powerpc.deb
Size/MD5 checksum: 2210792 82e9e27c6083a95c76c5817f9604178f

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_s390.udeb
Size/MD5 checksum: 643008 4861c78ea63b6c3c08c22a0c5326d981
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_s390.deb
Size/MD5 checksum: 1632976 01d289d460622382b59d07950305764f
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_s390.deb
Size/MD5 checksum: 951404 d92bb390489bed0abff58f7a1ceade6b
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_s390.deb
Size/MD5 checksum: 1014308 487c24f2af25797a857814af7c9c0d0b
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_s390.deb
Size/MD5 checksum: 2193782 f1fe472c802e929a57bd8c8560bd3009

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8c-4etch3_sparc.deb
Size/MD5 checksum: 4091340 970453ebfab8152c9c44ae210fbaa2a4
http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8c-4etch3_sparc.udeb
Size/MD5 checksum: 539054 7be1258f74165c4b037e202d2048f8ce
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8c-4etch3_sparc.deb
Size/MD5 checksum: 1010536 6444d6cc6fd838c82716462aacd1cf84
http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8c-4etch3_sparc.deb
Size/MD5 checksum: 2108000 ab0d0ccc72764a26b7767cace520b269
http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8c-4etch3_sparc.deb
Size/MD5 checksum: 2126386 61ddc204ee650cdd0f2b56e358134e2b

-- Debian GNU/Linux unstable alias sid --

Fixed in version 0.9.8g-9.

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Luciano Bello.

ORIGINAL ADVISORY:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

OTHER REFERENCES:
SA25878:
http://secunia.com/advisories/25878/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close