Subject: Re: [vserver] OpenSSL: various distributions on debian hosts affected or not?
From: Corey Wright <undefined@pobox.com>
Date: Fri, 16 May 2008 02:34:53 -0500

On Thu, 15 May 2008 23:52:09 +0200 (CEST)
"Daniel Hokka Zakrisson" <daniel@hozac.com> wrote:

> Guenther Fuchs wrote:
> > --- snip ---
> > A severe vulnerability was found in the random number generator (RNG)
> > of the Debian OpenSSL package, starting with version 0.9.8c-1 (and
> > similar packages in derived distributions such as Ubuntu). ...
> > --- snap ---
> >
> > My question to that is: Is it possible, that guests using different
> > distributions (example Fedora or RedHat) on Debian hosts are affected
> > by that?
> 
> As long as you haven't used your guests' DSA keys from the host, you
> should be safe. (From what I understand, anyway. I haven't read any of the
> advisories too carefeully.)

"Instead of mixing in random data for the initial seed, the only "random"
value that was used was the current process ID. On the Linux platform, the
default maximum process ID is 32,768, resulting in a very small number of
seed values being used for all PRNG operations."
 - http://metasploit.com/users/hdm/tools/debian-openssl/

and "a very small number of seed values" leads to "a small number of
possible generated private-public key pairs" (for ssh & ssl), a number so
small that brute force attacks become quite feasible.

the biggest problem is in the case that a user generated an ssh key pair
(ie RSA, DSA) on an affected debian host, but to facilitate passwordless ssh
auth (PubkeyAuthentication) on other hosts, transfered the public key to
hosts potentially running other distributions (~/.ssh/authorized_keys).  an
attacker could brute force their way into that user's account on those
hosts.  a debian host will detect the use of insecure keys, but
currently another distro won't, though it'll be that other distro
installation that will be vulnerable.

this also affects server ssl certs generated on a debian host, submitted to
a CA to be signed, but installed on any host.  most sites don't do client
auth, and server auth would require not only learning the private key but
also having it signed by a trusted CA, so authentication isn't the big
deal.  but if an encrypted data stream can be recorded (requiring
man-in-the-middle), it could be decrypted offline and the contents revealed
(eg website passwords, credit card numbers).

> > I would guess no as there are different libraries used inside, but I'm
> > not too far into that technical things ;-)

so though the "software problem" was isolated to debian (and all distros
that used the source in the debian package), the "output problem" exists
anywhere the output (eg keys, certs) of an affected openssl is used,
regardless of the distro.  that's what makes this particular security
problem and its effects so difficult to solve.

corey
-- 
undefined@pobox.com