Summary
Ubuntu Update for Linux kernel vulnerabilities USN-612-5
Solution
Please Install the Updated Packages.
Insight
Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys with options (such as "
no-port-forwarding"
or forced commands) were
ignored by the new ssh-vulnkey tool introduced in OpenSSH (see USN-612-2). This could cause some compromised keys not to be listed in ssh-vulnkey's output.
This update also adds more information to ssh-vulnkey's manual page.
Original advisory details:
A weakness has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems. As a result of this weakness, certain encryption keys are much more common than they should be, such that an attacker could guess the key through a brute-force attack given minimal knowledge of the system. This particularly affects the use of encryption keys in OpenSSH, OpenVPN and SSL certificates.
Affected
openssh update on Ubuntu 7.04 ,
Ubuntu 7.10 ,
Ubuntu 8.04 LTS
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2008-2285 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities