Debian and Ubuntu flaw leaves private SSL/SSH keys guessable

The Debian Security Advisory posted up DSA-1571-1 openssl -- predictable random number generator issue today and strongly advised its users to take steps to avoid possible compromising of any systems running on Debian, such as Ubuntu.The researcher Luciano Bello discovered a security flaw in Debian's random number generator that allows to predict a random generated number.  This is caused by an incorrect Debian change to the openssl package. As a result, cryptographic key material may be guessable.This problem not only affects Debian, but also all its derivatives, such as Ubuntu.It is strongly recommended that all cryptographic key material which has been generated by OpenSSL versions starting with 0.9.8c-1 on affected systems is recreated from scratch. Furthermore, all DSA keys ever used on affected systems for signing or authentication purposes should be considered compromised. News Source: Debian Security Advisory DSA-1571-1 Read full story...

 


http://feeds.feedburner.com/~r/neowin-main/~3/289737032/debian-and-ubuntu-flaw-leaves-private-sslssh-keys-guessable