News

Thursday, May 15, 2008

ubuntu-security-announce Digest, Vol 44, Issue 8

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-612-5] OpenSSH update (Jamie Strandboge)
2. [USN-612-6] OpenVPN regression (Jamie Strandboge)


----------------------------------------------------------------------

Message: 1
Date: Wed, 14 May 2008 13:12:09 -0400
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-612-5] OpenSSH update
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20080514171209.GB7483@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-612-5 May 14, 2008
openssh update
https://launchpad.net/bugs/230029
http://www.ubuntu.com/usn/usn-612-2
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.04:
openssh-client 1:4.3p2-8ubuntu1.4
openssh-client-udeb 1:4.3p2-8ubuntu1.4

Ubuntu 7.10:
openssh-client 1:4.6p1-5ubuntu0.5
openssh-client-udeb 1:4.6p1-5ubuntu0.5

Ubuntu 8.04 LTS:
openssh-client 1:4.7p1-8ubuntu1.2
openssh-client-udeb 1:4.7p1-8ubuntu1.2

After performing a standard system upgrade, users are encouraged to
re-run ssh-vulnkey on their systems.

Details follow:

Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys
with options (such as "no-port-forwarding" or forced commands) were
ignored by the new ssh-vulnkey tool introduced in OpenSSH (see
USN-612-2). This could cause some compromised keys not to be
listed in ssh-vulnkey's output.

This update also adds more information to ssh-vulnkey's manual page.

Original advisory details:

A weakness has been discovered in the random number generator used
by OpenSSL on Debian and Ubuntu systems. As a result of this
weakness, certain encryption keys are much more common than they
should be, such that an attacker could guess the key through a
brute-force attack given minimal knowledge of the system. This
particularly affects the use of encryption keys in OpenSSH, OpenVPN
and SSL certificates.


Updated packages for Ubuntu 7.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2-8ubuntu1.4.diff.gz

Size/MD5: 275922 b4c4369358cb99b5b7310671b4b6c644

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2-8ubuntu1.4.dsc

Size/MD5: 1074 b62e8d1771f57591e38883630e8909c1

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2.orig.tar.gz

Size/MD5: 920186 239fc801443acaffd4c1f111948ee69c

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.3p2-8ubuntu1.4_all.deb

Size/MD5: 1088 a41a7529e7dd57d65732a87fd4d12b1a

http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.3p2-8ubuntu1.4_all.deb

Size/MD5: 93516 1f18571e095d82d33d59a4b18ea1131d

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_amd64.udeb

Size/MD5: 173114 745de83450fd428f59b49819180ea6e5

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_amd64.deb

Size/MD5: 739984 c2b5359b14584f2ddd0a127b1e54ab05

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_amd64.udeb

Size/MD5: 185950 1e400a17bef0a1a046e3c6fe300d6cf1

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_amd64.deb

Size/MD5: 255684 ecffa0f893439bf7aa9dfa7794bb5865

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_amd64.deb

Size/MD5: 101900 07669fcf7d23a6e2f2790b5024e25107

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_i386.udeb

Size/MD5: 156808 50fb7499a1b3eaed7ce807d3159e901f

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_i386.deb

Size/MD5: 701964 93e2dda8a8bba51d2e1605960ed17222

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_i386.udeb

Size/MD5: 165478 3909dc0d1a3db832846523ecba68ed71

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_i386.deb

Size/MD5: 238158 38ac65e30b8c84b66ab8f982a630144d

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_i386.deb

Size/MD5: 101600 2f46f59002999da1d748a602d9df93eb

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_powerpc.udeb

Size/MD5: 178914 5f6bfcb0dfa67657a8af8b198d88189f

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_powerpc.deb

Size/MD5: 767888 b7456adaa4daf3d37f43d872876251dd

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_powerpc.udeb

Size/MD5: 184134 42cbfb13531030487616726f2a853c1b

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_powerpc.deb

Size/MD5: 259740 eb05ac7cbce7b5ef92055775e9c45f67

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_powerpc.deb

Size/MD5: 104364 3746fc6939f23cb8233daba48f784848

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_sparc.udeb

Size/MD5: 164244 3579357d22d64142d52d8acd4e393921

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_sparc.deb

Size/MD5: 751848 23d4205b7464735b63ecd28f0b789c02

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_sparc.udeb

Size/MD5: 172576 e12ca4505449cb662a293d720e4fce4e

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_sparc.deb

Size/MD5: 263476 276993c59b460c401920cfabcea46609

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_sparc.deb

Size/MD5: 101842 a8e676070f9512084d59d756f8a9f409

Updated packages for Ubuntu 7.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1-5ubuntu0.5.diff.gz

Size/MD5: 195823 5e9c4f68f3cd8bf5da85295ada5e0b81

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1-5ubuntu0.5.dsc

Size/MD5: 1169 b9acd86dd071c671af4187c47185f851

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1.orig.tar.gz

Size/MD5: 946439 cee58cd226138191561fa2d484e18f49

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.6p1-5ubuntu0.5_all.deb

Size/MD5: 1094 206c8e29f1a6dfb217c2d3d90d44bd79

http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.6p1-5ubuntu0.5_all.deb

Size/MD5: 80726 a49a595a3a8cfe999f1dbd26c1731f89

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_amd64.udeb

Size/MD5: 176418 362c6c124bbb2705f0d9c79132bf97a3

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_amd64.deb

Size/MD5: 747150 6e9a7a119044564417b8968b980e26f1

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_amd64.udeb

Size/MD5: 193380 1ecfc5db02898f44ed7391dc3e9b8403

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_amd64.deb

Size/MD5: 268756 104dff635669efaed7d6a77356ca0f8e

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_amd64.deb

Size/MD5: 88872 5b1a65df20e6ea4790be10e17c428fbc

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_i386.udeb

Size/MD5: 158796 2285a51be1c93f2b34d67f15e6fdbb82

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_i386.deb

Size/MD5: 706228 0631165438b1766e0db78765bfdb060e

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_i386.udeb

Size/MD5: 171690 268e919d460622342f3b21d3aa9e79b5

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_i386.deb

Size/MD5: 249768 378a2928fa89616f8b07a352c3e175d3

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_i386.deb

Size/MD5: 88516 d8c693407af5aaf4e102461171f3ee2a

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_lpia.udeb

Size/MD5: 158874 3cca405136fb0a926c931140297f8288

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_lpia.deb

Size/MD5: 677026 5b75905823737b22f9d088596109b003

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_lpia.udeb

Size/MD5: 171276 944b04a5ab7da2dea705b306717f0784

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_lpia.deb

Size/MD5: 243102 c465a99059c88b98df2dc3dee60ca4e9

http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_lpia.deb

Size/MD5: 88558 5f792ee09a6c0237072f84c1f95b3f15

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_powerpc.udeb

Size/MD5: 180852 7a253eac52ef9708fcd5d5f689f05018

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_powerpc.deb

Size/MD5: 774340 395be37533f4edc219863fd9bba242a6

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_powerpc.udeb

Size/MD5: 190236 f3063bd6ad4ebc74c6232515276e4114

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_powerpc.deb

Size/MD5: 272004 2d6a98684f6e915c82b958ca7823d237

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_powerpc.deb

Size/MD5: 91234 f3e1454cb89fea2dbdd20fcbfcd52386

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_sparc.udeb

Size/MD5: 166886 7895b2872ae485b385039e760d5f44ec

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_sparc.deb

Size/MD5: 759160 129a2a85c91eb3f8d5a1165cef9391fb

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_sparc.udeb

Size/MD5: 179100 9bbca7ca7ecb4e4fa9e16cfe531911c4

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_sparc.deb

Size/MD5: 276562 0a5a7c1f1af8d5d4b5928d932b9f8a33

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_sparc.deb

Size/MD5: 88840 bd7bc566ead7a834eae8519ef06db84c

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.7p1-8ubuntu1.2.diff.gz

Size/MD5: 209139 80acb15215b83533f187fac836e24ca1

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.7p1-8ubuntu1.2.dsc

Size/MD5: 1135 6e43d250b57c64d6b942083668589f97

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.7p1.orig.tar.gz

Size/MD5: 1009361 bea83d2e0f9ac7b3d4393d693e68b5c1

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.7p1-8ubuntu1.2_all.deb

Size/MD5: 1084 0f68b9046c74db0e57bddd6c1b739bbf

http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.7p1-8ubuntu1.2_all.deb

Size/MD5: 88848 f6e0f4ef0046a7897736c46cc108508a

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_amd64.udeb

Size/MD5: 179260 f2a58225ba895c261ef823086be965c5

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_amd64.deb

Size/MD5: 760846 c727a95841f0d0c94f114884e6a99ac0

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_amd64.udeb

Size/MD5: 195496 62cfa3d52ce0918f88787b30cc8b7e25

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_amd64.deb

Size/MD5: 272818 8f3310bde9e7420d2a698b055ea73ecb

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_amd64.deb

Size/MD5: 96744 c3a3f0eb608c9c1a9ca0e35061494415

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_i386.udeb

Size/MD5: 161824 f516011da3156b43ecdfa2724e63fbb9

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_i386.deb

Size/MD5: 720448 b1945e94fa0397da83ef5af705ae1f26

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_i386.udeb

Size/MD5: 174332 3604f10b4e2619edce52f50303a98881

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_i386.deb

Size/MD5: 254020 6710da9f44ac6e18a4627afbb7505f26

http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_i386.deb

Size/MD5: 96384 dd61e122cc6e69fd6ea61ec368b35741

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_lpia.udeb

Size/MD5: 161636 65e704f5528a147579ae40de2c487765

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_lpia.deb

Size/MD5: 713956 a619b1749570ce9864b343132f1e5d13

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_lpia.udeb

Size/MD5: 174210 b31d7b694d937f0025ff96069d334158

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_lpia.deb

Size/MD5: 252856 368e0e5fa2665faadfd8ad63341acf87

http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_lpia.deb

Size/MD5: 96412 ebe007544778b04ec01a89a1e0e3e2bc

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_powerpc.udeb

Size/MD5: 185712 bdbaeeea99557baf7c19e2a0f70abd2a

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_powerpc.deb

Size/MD5: 797596 2129e032f78d1d4e13e1890c3bf7f85f

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_powerpc.udeb

Size/MD5: 194522 e9263b742d7b7319d598cb44c4049f1d

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_powerpc.deb

Size/MD5: 279014 4f5e89c16964c533ad0fafd1d7e2da60

http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_powerpc.deb

Size/MD5: 99164 9511ff26b13272bceb56c98066e6c4a9

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_sparc.udeb

Size/MD5: 169976 0b6c2aa06082048a1df1c44e924a385c

http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_sparc.deb

Size/MD5: 723794 42355feee72c77139e88c383fd33d920

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_sparc.udeb

Size/MD5: 181574 d5e603a641b3238f172715d71624fbc9

http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_sparc.deb

Size/MD5: 258324 871b3c0e5b963225ce9e79d02483de7a

http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_sparc.deb

Size/MD5: 96612 2ed0f8f6827dda7f51c942b1b1533729


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20080514/9e66dcd6/attachment-0001.pgp


------------------------------

Message: 2
Date: Wed, 14 May 2008 16:20:25 -0400
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-612-6] OpenVPN regression
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20080514202025.GC7483@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-612-6 May 14, 2008
openvpn regression
https://launchpad.net/bugs/230193
https://launchpad.net/bugs/230208
http://www.ubuntu.com/usn/usn-612-3
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.04:
openssl-blacklist 0.1-0ubuntu0.7.04.2
openvpn 2.0.9-5ubuntu0.2

Ubuntu 7.10:
openssl-blacklist 0.1-0ubuntu0.7.10.2
openvpn 2.0.9-8ubuntu0.2

Ubuntu 8.04 LTS:
openssl-blacklist 0.1-0ubuntu0.8.04.2
openvpn 2.1~rc7-1ubuntu3.2

After a standard system upgrade you need to restart openvpn to effect
the necessary changes.

Details follow:

USN-612-3 addressed a weakness in OpenSSL certificate and keys
generation in OpenVPN by adding checks for vulnerable certificates
and keys to OpenVPN. A regression was introduced in OpenVPN when
using TLS and multi-client/server which caused OpenVPN to not start
when using valid SSL certificates.

It was also found that openssl-vulnkey from openssl-blacklist
would fail when stderr was not available. This caused OpenVPN to
fail to start when used with applications such as NetworkManager.

This update fixes these problems. We apologize for the
inconvenience.

Original advisory details:

A weakness has been discovered in the random number generator used
by OpenSSL on Debian and Ubuntu systems. As a result of this
weakness, certain encryption keys are much more common than they
should be, such that an attacker could guess the key through a
brute-force attack given minimal knowledge of the system. This
particularly affects the use of encryption keys in OpenSSH, OpenVPN
and SSL certificates.


Updated packages for Ubuntu 7.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.2.dsc

Size/MD5: 548 6fbd0fe22ee9e03f7953beab58f769c2

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.2.tar.gz

Size/MD5: 7778456 eee4434860560905a3af66468100a348

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.2.diff.gz

Size/MD5: 61701 d39b369ff928f451c70bf0779e75f405

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.2.dsc

Size/MD5: 641 262ef73ef3557dc4959889b46848138e

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9.orig.tar.gz

Size/MD5: 669076 60745008b90b7dbe25fe8337c550fec6

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.2_all.deb

Size/MD5: 3535226 ad5b8c02f9edf0c7701867fcace63d99

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.2_amd64.deb

Size/MD5: 356590 f64d86a6b713cd8326a905e857c3d828

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.2_i386.deb

Size/MD5: 337570 f6898a1af5591c8f8ca93bf3241c7553

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.2_powerpc.deb

Size/MD5: 358182 501e0707d6190c33fb0570f5ca1b3541

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.2_sparc.deb

Size/MD5: 336370 d18a832bf8564796069c8e66e8c6fb5a

Updated packages for Ubuntu 7.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.2.dsc

Size/MD5: 548 8abff8f249ed0e1a0e944716a7bc917b

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.2.tar.gz

Size/MD5: 7778457 79b3c02e1d9c759172e8bd696a3d392c

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2.diff.gz

Size/MD5: 65145 40ac90ce5aca10e2be6410eef3bc7d45

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2.dsc

Size/MD5: 642 350b124caa02ab5015a7faae3d5d11d6

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9.orig.tar.gz

Size/MD5: 669076 60745008b90b7dbe25fe8337c550fec6

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.2_all.deb

Size/MD5: 3535452 16cee119a4c57d8d6644e638273c831d

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2_amd64.deb

Size/MD5: 362166 087beb48ed1ec72f4aac38d425e404af

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2_i386.deb

Size/MD5: 341986 c2d7d6f13b7b8f94c4687d7dcd0e5940

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2_lpia.deb

Size/MD5: 343546 bc15cd4c335ef8a007f85cff8e1e308f

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2_powerpc.deb

Size/MD5: 363492 75ca3479943634cff266abdb10d9635d

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.2_sparc.deb

Size/MD5: 341774 ae2df701be65b3cf2cbae44ae3f47fbc

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.2.dsc

Size/MD5: 548 a4ba4a5fefb358127a9887ead15899fb

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.2.tar.gz

Size/MD5: 7778452 ed6ed6c9d44d498da27c467112da51dc

http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2.diff.gz

Size/MD5: 36383 df12dec18746624b44785c17444ac461

http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2.dsc

Size/MD5: 646 1e4f69e842af1e8dfedba7df39e500ef

http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7.orig.tar.gz

Size/MD5: 786288 dac8b5104b5eb105ba82b2525d371d58

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.2_all.deb

Size/MD5: 3534948 258d2779ea1fb5fe8dd67eb9f920ed06

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2_amd64.deb

Size/MD5: 391056 7756bf70867fc0a28f448b94af4bcdf3

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2_i386.deb

Size/MD5: 372454 f9c5766c86e6f20dab634ccf48a890a0

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2_lpia.deb

Size/MD5: 371466 14e8bc2c2adc623e65b2e862b4d56ab2

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2_powerpc.deb

Size/MD5: 391702 92b67d4672dd43d46ee52da557289760

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.2_sparc.deb

Size/MD5: 369260 ae821d7f2f582c459e1796d7fa587da1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20080514/80e0f2ae/attachment-0001.pgp


------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 44, Issue 8
*******************************************************

No comments:

Blog Archive