1. Ubuntu Security Notices
  2. USN-612-5

USN-612-5: OpenSSH update

Publication date

14 May 2008

Overview

OpenSSH update

Releases

Packages

Details

Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys
with options (such as “no-port-forwarding” or forced commands) were
ignored by the new ssh-vulnkey tool introduced in OpenSSH (see
USN-612-2). This could cause some compromised keys not to be
listed in ssh-vulnkey’s output.

This update also adds more information to ssh-vulnkey’s manual page.

Original advisory details:

A weakness has been discovered in the random number generator used
by OpenSSL on Debian and Ubuntu systems. As a result of this
weakness, certain encryption keys are much more common than they
should be, such that an attacker could guess the key through a
brute-force attack given minimal knowledge of the system. This
particularly affects the use of encryption keys in OpenSSH, OpenVPN
and SSL certificates.

Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys
with options (such as “no-port-forwarding” or forced commands) were
ignored by the new ssh-vulnkey tool introduced in OpenSSH (see
USN-612-2). This could cause some compromised keys not to be
listed in ssh-vulnkey’s output.

This update also adds more information to ssh-vulnkey’s manual page.

Original advisory details:

A weakness has been discovered in the random number generator used
by OpenSSL on Debian and Ubuntu systems. As a result of this
weakness, certain encryption keys are much more common than they
should be, such that an attacker could guess the key through a
brute-force attack given minimal knowledge of the system. This
particularly affects the use of encryption keys in OpenSSH, OpenVPN
and SSL certificates.

Update instructions

After performing a standard system upgrade, users are encouraged to re-run ssh-vulnkey on their systems.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
8.04 hardy openssh-client –  1:4.7p1-8ubuntu1.2
openssh-client-udeb –  1:4.7p1-8ubuntu1.2
7.10 gutsy openssh-client –  1:4.6p1-5ubuntu0.5
openssh-client-udeb –  1:4.6p1-5ubuntu0.5
7.04 feisty openssh-client –  1:4.3p2-8ubuntu1.4
openssh-client-udeb –  1:4.3p2-8ubuntu1.4

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›