An unpatched security hole in Ubuntu Linux 8.04 LTS operating system could be used by attackers to send a crafted packet and cause a denial of service via application crash in applications linked against OpenSSL to take control of vulnerable servers. Also ruby package can be used to run a malicious script – an attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program. It is recommended that you immediately update your system. Affected systems:
OpenSSL Vulnerability – Ubuntu Linux LTS 8.04 and corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
Ruby Vulnerability – Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 LTS and corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
How do I fix this issue
Simply type the following two commands:
$ sudo apt-get update
$ sudo apt-get upgrade
After a standard system upgrade you need to reboot your computer to effect the necessary change:
$ sudo reboot
There was random number generator vulnerability in Debian OpenSSL package and similar packages in derived distributions such as Ubuntu / others. Many of our regular readers would like to know:
Can bug present in the Debian OpenSSL packages affect Red Hat / FreeBSD / CentOS Linux workstation / server users?
Short answer, yes.
All keys generated using Debian OpenSSL package must be replaced on other system including FreeBSD / CentOS / RHEL etc as all keys considered as compromized. OpenSSL, OpenSSH and OpenVPN are badly effected. For example, if you use OpenSSH key to get into other Linux / UNIX servers and if key-pair is generated with a vulnerable OpenSSL library, you are at the risk as the key can be reproduced easily.
Bottom, line you need to update keys on other boxes too.
This bug really was a bad one. I’ve client with over 200 Debian Linux server. Updating all systems wasn’t the problem. With the help of Cfengine I was able to push updates but managing all workstation ssh keys (over 1000+ Windows and Linux/BSD workstations) and testing everything took so much time. Debian shouldn’t have modified the package in first place. I also had to upgrade over 30 SSL certificates and a whole new CA for OpenVPN. Luckily VeriSign is providing revocation and replacement of SSL certificates (generally it is not provided free of charge) till 30-June-2008.
How do I find out all weak keys?
You can check all your weak keys with following commands:
# wget http://security.debian.org/project/extra/dowkd/dowkd.pl.gz
# wget http://security.debian.org/project/extra/dowkd/dowkd.pl.gz.asc
# gpg --keyserver subkeys.pgp.net --recv-keys 02D524BE
# gpg --verify dowkd.pl.gz.asc
# gunzip dowkd.pl.gz
# perl dowkd.pl host localhost
You should see 0 weak keys. If you run Debian or Ubuntu Linux upgrade your OpenSSL and fix all the affected softwares. There is also wiki page that will address all your concerns. Overall it lasted for few days for large clients. How many hours did you spend updating Debian systems?
There is a serious security flaw in Debian openssl – the random number generator in Debian’s openssl package is predictable. As a result, cryptographic key material may be guessable.
=> Package : openssl
=> Vulnerability : predictable random number generator
=> Problem type : remote
=> Debian-specific: yes
=> CVE Id(s) : CVE-2008-0166
=> Checkout description and recommended fix at the following url:
[SECURITY] [DSA 1571-1] New openssl packages fix predictable random number generator
In this tutorial you will learn about Installing SSL Certificate (Secure Server Certificate) to secure communication between Postfix SMTP server and mail client such as Outlook or Thunderbird.
[click to continue…]