TITLE: NetBSD False Intel Hardware RNG Detection Security Issue SECUNIA ADVISORY ID: SA19585 VERIFY ADVISORY: http://secunia.com/advisories/19585/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: >From remote OPERATING SYSTEM: NetBSD 1.x http://secunia.com/product/255/ DESCRIPTION: A security issue has been reported in NetBSD, which can weaken certain security features. The problem is that the driver for Intel's RNG (Random Number Generator) incorrectly detects the device as present on some hardware. This causes the driver to feed a constant stream of bytes with value 255 into the entropy pool for the kernel RNG resulting in poor-quality or highly predictable output. This may e.g. cause the SSH daemon to use predictable keys on certain systems. SOLUTION: The security issue has been fixed in NetBSD-1-6 branch (February 26, 2006). PROVIDED AND/OR DISCOVERED BY: The vendor credits Matthias Scheler. ORIGINAL ADVISORY: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-009.txt.asc ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------