----- Forwarded message from Planet Debian -----

From: Planet Debian
Subject: Erich Schubert -- Consequences of the SSH/SSL weakness
To: ticker-planetdebian[bei]lists.infodrom[punkt]org
Date: Wed, 14 May 2008 23:56:46 +0200 (CEST)

http://blog.drinsama.de/erich/en/linux/2008051401-consequences-of-sslssh-weakness.html

Erich Schubert -- Consequences of the SSH/SSL weakness

Let me just point out, that the consequences affect all users of
SSH. Therefore IMHO all *other Linux and BSD distributions should
release a security update to OpenSSH as well, to prevent the use
of insecure (too common) keys*, because it threatens the security
of their systems as well!

I'll go into the details of the security issues below, but let me
first note some things as I understood them.

Apparently, there are only about 2^15 different keys generated by
the SSH versions shipped with Debian for 2 years. It's really
surprising that noone noticed this earler. This is just about
32000 different keys. The weakness is caused by a bad random
number generator in the Debian package.

Hackers have already generated all these 32000 different keys, for
two key lengths and types. In a few hours, they'll also have
generated all the 4096 bit keys that could have been generated.
Other key lengths are uncommon and sometimes might even be
unsupported. Most people use keys with length 1024 or 2048.

So we now have about 32000 keys which are used by lots of Debian
and Ubuntu users. That's not very much. Now you have to realize
how the keys are used:

The key is used to log into a system without a password. Sometimes
a key is protected with a passphrase (you really should do that),
but this doesn't help here, because an unencrypted clone of the
key was already generated.

Sometimes (or let me even claim 'often') one such key is also used
to login as root into a server. This is equivalent to just 32000
different passwords being used as root passwords. So with about
this number of tries, an attacker might be able to log into your
server as 'root'!

Now the weakness is introduced by the client, not by the server.
*If your server is running e.g. RedHat, it doesn't mean it is
secure!*.

In fact, if your server is running Debian and you installed the
latest security update, it will be much more secure than the
RedHat server. Because the Debian server has a "blacklist of keys
that are too common". The other-Linux server who doesn't have this
blacklist doesn't know that a certain key is not trustworthy.

*Fixing the bad key-generation is just half of the deal.
"Recalling" all the keys in use out there is the big challenge*,
that affects all systems using SSH (and to a certain extend, SSL).
The most reliable way is if all other distributions would release
a securit update as well, which refuses to accept the keys that
were generated by vulnerable Debian systems.

Let me just repeat this: *Any Linux/Unix/*BSD system is vulnerable
that "grants access" to a key that was generated on an affected
Debian or Ubuntu system.* (Until the system has a reliable
detection method of such weak keys.)

Note that if you are not careful, you might lock yourself out from
your server. If you don't have or remember the password, a
security update might disable your login key. So if your key is
bad, "make sure to generate a new, secure key and distribute it
ASAP". Also remove any vulnerable key ASAP; remember that hackers
now have a list of all possible keys and could use that to
brute-force login.

09:43pm[1]

Links:
1. http://blog.drinsama.de/erich/en/linux/2008051401-consequences-of-sslssh-weakness.html

--
To UNSUBSCRIBE, send an email to ticker-planetdebian-request[bei]lists.infodrom[punkt]org
with a subject of "unsubscribe". Trouble? Contact listmaster[bei]lists.infodrom[punkt]org

----- End forwarded message -----

--
,-----------------------------------------------------------------------------.
| Stefan Lütje | "Die Zukunft wird morgen besser sein." |
| stefan.luetje[bei]t-online[punkt]de | George W. Bush |
`----Key fingerprint = BCB2 48E4 9211 C975 5A3F B192 9B6E CCCF 99CC 44FA-----'

-------------- nächster Teil --------------
Ein Dateianhang mit Binärdaten wurde abgetrennt...
Dateiname : nicht verfügbar
Dateityp : application/pgp-signature
Dateigröße : 189 bytes
Beschreibung: Digital signature
URL : http://www.easylinux.de/pipermail/ubuntu/attachments/20080515/552a81c9/attachment.pgp