bugtraq - Re: /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87ej7uc9e0.fsf@mid.deneb.enyo.de>
Date: Thu, 22 May 2008 23:32:39 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: "Asterisk Security Team" <security@...erisk.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

* Asterisk Security Team:

>    +------------------------------------------------------------------------+
>    | Resolution | Since this is not a vulnerability in Asterisk itself but  |
>    |            | in a tool that Asterisk uses, there will be no new        |
>    |            | releases made; however, users who are affected by the     |
>    |            | Debian OpenSSL vulnerability are strongly encouraged to   |
>    |            | upgrade their package of OpenSSL to an uncompromised      |
>    |            | version (version 0.9.8c-4 or later) and regenerate all    |
>    |            | keys used by Asterisk.                                    |
>    +------------------------------------------------------------------------+

Correction: The first fixed version are 0.9.8c-4etch3 (on the
etch/stable branch) and 0.9.8g-9 (for sid/unstable and lenny/testing).
Plain 0.9.8c-4 (and 0.9.8c-4etch1 and 0.9.8c-4etch2) are vulnerable.