thr3ads.net - asterisk announce - [asterisk-announce] /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised [May 2008]

If this information is useful, please help other people find it:
Share via:
Asterisk Security Team
2008-May-22 14:54 UTC
[asterisk-announce] /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

Asterisk Project Security Advisory - AST-2008-007

   +------------------------------------------------------------------------+
   |      Product       | Asterisk                                          |
   |--------------------+---------------------------------------------------|
   |      Summary       | Asterisk installations using cryptographic keys   |
   |                    | generated by Debian-based systems may be using a  |
   |                    | vulnerable implementation of OpenSSL              |
   |--------------------+---------------------------------------------------|
   | Nature of Advisory | Compromised cryptographic keys                    |
   |--------------------+---------------------------------------------------|
   |   Susceptibility   | Users of RSA for IAX2 authentication and users of |
   |                    | DUNDi                                             |
   |--------------------+---------------------------------------------------|
   |      Severity      | Critical                                          |
   |--------------------+---------------------------------------------------|
   |   Exploits Known   | None specific to Asterisk, but OpenSSL exploits   |
   |                    | are circulating                                   |
   |--------------------+---------------------------------------------------|
   |    Reported On     | 13 May 2008                                       |
   |--------------------+---------------------------------------------------|
   |    Reported By     | Luciano Bello                                     |
   |--------------------+---------------------------------------------------|
   |     Posted On      | May 16, 2008                                      |
   |--------------------+---------------------------------------------------|
   |  Last Updated On   | May 22, 2008                                      |
   |--------------------+---------------------------------------------------|
   |  Advisory Contact  | Mark Michelson < mmichelson AT digium DOT com > 
|
   |--------------------+---------------------------------------------------|
   |      CVE Name      | CVE-2008-0166                                     |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Description | The Debian team recently announced that cryptographic    |
   |             | keys generated by their OpenSSL package were created     |
   |             | using a random number generator with predictable         |
   |             | results. This affects Debian's stable and unstable      
|
   |             | distributions, as well as Debian-derived systems such as |
   |             | Ubuntu. See the links in the "Links" session of
this     |
   |             | advisory for more information about the vulnerability.   |
   |             |                                                          |
   |             | Asterisk is not directly affected by this vulnerability; |
   |             | however, Asterisk's 'astgenkey' script uses
OpenSSL in   |
   |             | order to generate cryptographic keys. Therefore,         |
   |             | Asterisk users who use RSA for authentication of IAX2    |
   |             | calls and who use DUNDi may be using compromised keys.   |
   |             | This vulnerability affects any such installation whose   |
   |             | cryptographic keys were generated on a Debian-based      |
   |             | system, even if the Asterisk installation itself is not  |
   |             | on a Debian-based system.                                |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Resolution | Since this is not a vulnerability in Asterisk itself but  |
   |            | in a tool that Asterisk uses, there will be no new        |
   |            | releases made; however, users who are affected by the     |
   |            | Debian OpenSSL vulnerability are strongly encouraged to   |
   |            | upgrade their package of OpenSSL to an uncompromised      |
   |            | version (version 0.9.8c-4 or later) and regenerate all    |
   |            | keys used by Asterisk.                                    |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |                           Affected Versions                            |
   |------------------------------------------------------------------------|
   |              Product              | Release Series |                   |
   |-----------------------------------+----------------+-------------------|
   |       Asterisk Open Source        |     1.0.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |       Asterisk Open Source        |     1.2.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |       Asterisk Open Source        |     1.4.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |     Asterisk Business Edition     |     A.x.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |     Asterisk Business Edition     |     B.x.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |     Asterisk Business Edition     |     C.x.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |            AsteriskNOW            |  pre-release   | N/A               |
   |-----------------------------------+----------------+-------------------|
   | Asterisk Appliance Developer Kit  |     0.x.x      | N/A               |
   |-----------------------------------+----------------+-------------------|
   |    s800i (Asterisk Appliance)     |     1.0.x      | N/A               |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |                              Corrected In                              |
   |------------------------------------------------------------------------|
   |              Product               |              Release              |
   |------------------------------------+-----------------------------------|
   |                N/A                 |                N/A                |
   |------------------------------------+-----------------------------------|
   |------------------------------------+-----------------------------------|
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |     Links      | http://www.debian.org/security/2008/dsa-1571          |
   |                |                                                       |
   |                | http://wiki.debian.org/SSLkeys                        |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Asterisk Project Security Advisories are posted at                     |
   | http://www.asterisk.org/security                                       |
   |                                                                        |
   | This document may be superseded by later versions; if so, the latest   |
   | version will be posted at                                              |
   | http://downloads.digium.com/pub/security/AST-2008-007.pdf and          |
   | http://downloads.digium.com/pub/security/AST-2008-007.html             |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |                            Revision History                            |
   |------------------------------------------------------------------------|
   |       Date        |        Editor        |       Revisions Made        |
   |-------------------+----------------------+-----------------------------|
   | May 15, 2008      | Mark Michelson       | Initial advisory            |
   +------------------------------------------------------------------------+

               Asterisk Project Security Advisory - AST-2008-007
              Copyright (c) 2008 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.
Possibly Parallel Threads

Search for more maybe matching threads
asterisk announce - May 2008 - /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

[asterisk-announce] /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

Possibly Parallel Threads

Wisdom of the Ancients
