GULP! Oh well, no hacks where made exploiting this whilst it was unknown... if you run Ubuntu then take note as its based on debian, you should get an update about this and it asks you to remake the security certificates... (if you dont use ssl then you are probably fine...)
http://www.theregister.co.uk/2008/05/13/debian_openssl_bug/Debian has warned of a vulnerability in its cryptographic functions that could leave systems open to attack.
The use of a cryptographically flawed pseudo random number generator in Debian's implementation of OpenSSL meant that potentially predictable keys were generated. Versions of Debian's OpenSSL packages starting with 0.9.8c-1 (released in September 2006) are potentially vulnerable.
Many types of cryptographic keys (including SSH, SSL session keys, OpenVPN and others) generated on affected systems may be weak, so the impact of the bug is potentially far reaching.
Sys admins are advised to generate new cryptographic keys after updating their software, as explained in Debian's advisory. Security notification firm Secunia notes that Debian's OPenSSL update also addresses a potential denial of service risk.
Debian said the flaw arises for a change it alone made in the OpenSSL package, suggesting that Linux distributions not derived from Debian are free from the bug. One Reg reader has traced the flaw back to an attempt to silence a warning from a debugging tool. Another has suggested the bug resides within OpenSSL itself and dates from May 2006, a theory we are currently investigating. ®
Rate this story
A Black Eye For Debian
News of a massive security hole in the Debian distribution of Linux has dropped jaws everywhere, mine included. It's the sort of thing that speaks very badly indeed for the way Debian does code review -- exactly what's required urgently for open source to work well.
The problem involves Debian's version of the openssl package, which was changed back in 2006 in such a way that the encryption keys generated by the package could theoretically be guessed by an attacker. Bad. But what's worse, every encryption key generated with that edition of openssl since the change was made -- since 2006 -- now has to be dumped. (Instructions on how to replace compromised keys are forthcoming.)
This is a huge mess, to put it mildly. Debian's one of the most broadly used distributions out there, and many other distributions -- Ubuntu, just to name one -- are built from it. And anyone who's built a derivative distribution from Debian will have almost certainly inherited this problem. The most staggering thing is that this particular change took upwards of two years to get flagged, during which time who knows how many potentially weak encryption keys have been generated and now have to be junked.
This all involves something people who are critical of open source single out, quite rightfully, as a problem with the process: just because the code is out there for review doesn't mean it's automatically going to get looked at. It also has to be looked at in a timely fashion by people who know what to look for, and who are in a position to do something about it -- and the changes have to be accepted by the people responsible for the code.
In short, just making source available for review is barely even the first step toward making open source a viable methodology. And it says nothing about the people involved -- about how trustworthy they are, what their work habits or pedigree for code review are like, and so on. These things don't come automatically.
I should emphasize that if this problem had happened with a closed source product, there's a fair chance it might only have surfaced in the form of a key exploit tool for hackers. At least here the problem was discovered in the right place: in the source itself. But I'm hoping Debian takes this kind of thing as hard evidence that just being "open" isn't in and of itself enough. And I also hope this isn't just the tip of a very pointy iceberg.
Topic: Debian fixes serious crypto bug (Read 1024 times)