Debian OpenSSL Package Random Number Generator Weakness

Bugtraq ID:	29179
Class:	Design Error
CVE:	CVE-2008-0166
Remote:	Yes
Local:	Yes
Published:	May 13 2008 12:00AM
Updated:	Oct 19 2012 03:30PM
Credit:	Luciano Bello
Vulnerable:	Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Stonesoft StoneGate SSL VPN Engine 1.1 Stonesoft StoneGate IPS Sensor and Analyzer 4.2.2 Stonesoft StoneGate IPS Sensor and Analyzer 4.2 Stonesoft StoneGate IPS Sensor and Analyzer 4.1.2 Stonesoft StoneGate IPS Sensor and Analyzer 4.1 Stonesoft StoneGate IPS Sensor and Analyzer 4.0 Stonesoft StoneGate High Availability Firewall and VPN 4.2.1 Stonesoft StoneGate High Availability Firewall and VPN 4.2 Rsyncrypto Rsyncrypto 1.10 Rsyncrypto Rsyncrypto 0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Asterisk Asterisk 0
Not Vulnerable:	Stonesoft StoneGate IPS Sensor and Analyzer 4.2.3 Stonesoft StoneGate IPS Sensor and Analyzer 4.1.3 Stonesoft StoneGate IPS Sensor and Analyzer 4.0.1 Stonesoft StoneGate High Availability Firewall and VPN 4.2.2

Debian OpenSSL Package Random Number Generator Weakness

The Debian OpenSSL package is prone to a random-number-generator weakness.

Attackers can exploit this issue to predict random data used to generate encryption keys by certain applications. This may help attackers compromise encryption keys and gain access to sensitive data.

This issue affects only a modified OpenSSL package for Debian prior to version 0.9.8c-4etch3.

Debian OpenSSL Package Random Number Generator Weakness

Attackers can use brute-force techniques to exploit this issue.

An automated tool to brute-force keys is available at the following location:
http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2

Please note that Symantec has not tested nor verified this application.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following Ruby and Python scrips are also available:

• /data/vulnerabilities/exploits/29179.rb
• /data/vulnerabilities/exploits/29179-warcat.py

Debian OpenSSL Package Random Number Generator Weakness

Solution:
The vendor has released updates. Please see the references for more information.

Debian OpenSSL Package Random Number Generator Weakness

References:

• Debian Homepage (Debian)
  
• OpenSSL PRNG Debian Toys (H D Moore)
  
• /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys g ("Asterisk Security Team" )
  
• Advisory - Rsyncrypto maybe affected from Debian OpenSSL reduced entropy problem (Aviram Jenik )
  
• Debian generated SSH-Keys working exploit ([email protected])
  
• Stonesoft Corporation Security Advisory (Stonesoft)
  
• Vulnerability Note VU#925211 (US-CERT)