Hello all,<br>According to the following USN I simply need to do a standard system upgrade. I did an "apt-get update; apt-get upgrade" but did not get the openssl-blacklist package. I had to do a separate "apt-get install openssl-blacklist" to get this package on Ubuntu 6.06 LTS. Which sources do I need to have listed in my /etc/apt/sources.list to be able to do a standard "apt-get upgrade" to get this package. I want to make sure that I have the required minimum sources listed to get such security packages.<br>
<br>Thanks in advance<br>Ganesh<br><br><div class="gmail_quote">On Wed, May 21, 2008 at 11:31 AM, Jamie Strandboge <<a href="mailto:jamie@canonical.com">jamie@canonical.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
===========================================================<br>
Ubuntu Security Notice USN-612-8 May 21, 2008<br>
openssl-blacklist update<br>
<a href="http://www.ubuntu.com/usn/usn-612-1" target="_blank">http://www.ubuntu.com/usn/usn-612-1</a><br>
<a href="http://www.ubuntu.com/usn/usn-612-3" target="_blank">http://www.ubuntu.com/usn/usn-612-3</a><br>
===========================================================<br>
<br>
A security issue affects the following Ubuntu releases:<br>
<br>
Ubuntu 6.06 LTS<br>
Ubuntu 7.04<br>
Ubuntu 7.10<br>
Ubuntu 8.04 LTS<br>
<br>
This advisory also applies to the corresponding versions of<br>
Kubuntu, Edubuntu, and Xubuntu.<br>
<br>
The problem can be corrected by upgrading your system to the<br>
following package versions:<br>
<br>
Ubuntu 6.06 LTS:<br>
openssl-blacklist 0.1-0ubuntu0.6.06.1<br>
<br>
Ubuntu 7.04:<br>
openssl-blacklist 0.1-0ubuntu0.7.04.4<br>
<br>
Ubuntu 7.10:<br>
openssl-blacklist 0.1-0ubuntu0.7.10.4<br>
<br>
Ubuntu 8.04 LTS:<br>
openssl-blacklist 0.1-0ubuntu0.8.04.4<br>
<br>
In general, a standard system upgrade is sufficient to effect the<br>
necessary changes.<br>
<br>
Details follow:<br>
<br>
USN-612-3 addressed a weakness in OpenSSL certificate and key<br>
generation in OpenVPN by introducing openssl-blacklist to aid in<br>
detecting vulnerable private keys. This update enhances the<br>
openssl-vulnkey tool to check X.509 certificates as well, and<br>
provides the corresponding update for Ubuntu 6.06. While the<br>
OpenSSL in Ubuntu 6.06 was not vulnerable, openssl-blacklist is<br>
now provided for Ubuntu 6.06 for checking certificates and keys<br>
that may have been imported on these systems.<br>
<br>
This update also includes the complete RSA-1024 and RSA-2048<br>
blacklists for all Ubuntu architectures, as well as support for<br>
other future blacklists for non-standard bit lengths.<br>
<br>
You can check for weak SSL/TLS certificates by installing<br>
openssl-blacklist via your package manager, and using the<br>
openssl-vulnkey command.<br>
<br>
$ openssl-vulnkey /path/to/certificate_or_key<br>
<br>
This command can be used on public certificates and private keys<br>
for any X.509 certificate or RSA key, including ones for web<br>
servers, mail servers, OpenVPN, and others. If in doubt, destroy<br>
the certificate and key and generate new ones. Please consult the<br>
documentation for your software when recreating SSL/TLS<br>
certificates. Also, if certificates have been generated for use<br>
on other systems, they must be found and replaced as well.<br>
<br>
Original advisory details:<br>
<br>
A weakness has been discovered in the random number generator used<br>
by OpenSSL on Debian and Ubuntu systems. As a result of this<br>
weakness, certain encryption keys are much more common than they<br>
should be, such that an attacker could guess the key through a<br>
brute-force attack given minimal knowledge of the system. This<br>
particularly affects the use of encryption keys in OpenSSH, OpenVPN<br>
and SSL certificates.<br>
<br>
<br>
Updated packages for Ubuntu 6.06 LTS:<br>
<br>
Source archives:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.6.06.1.dsc" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.6.06.1.dsc</a><br>
Size/MD5: 548 b437e5037437d46ba896cf28be43fa55<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.6.06.1.tar.gz" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.6.06.1.tar.gz</a><br>
Size/MD5: 8998682 154e882671f25f5ef5a100ef2709cd4e<br>
<br>
Architecture independent packages:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.6.06.1_all.deb" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.6.06.1_all.deb</a><br>
Size/MD5: 4235438 b78f5861f72699f7699e3f60d7e7d235<br>
<br>
Updated packages for Ubuntu 7.04:<br>
<br>
Source archives:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.4.dsc" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.4.dsc</a><br>
Size/MD5: 600 8045fc0b37070b448b00123c395af0fd<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.4.tar.gz" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.4.tar.gz</a><br>
Size/MD5: 8999060 4a23e360873f70d978401837a5a1a462<br>
<br>
Architecture independent packages:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.4_all.deb" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.04.4_all.deb</a><br>
Size/MD5: 4236958 7ec420cb408154facae641776ac1aeaf<br>
<br>
Updated packages for Ubuntu 7.10:<br>
<br>
Source archives:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.4.dsc" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.4.dsc</a><br>
Size/MD5: 600 e484758b7e017b511fc34eff1878a2eb<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.4.tar.gz" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.4.tar.gz</a><br>
Size/MD5: 8999062 1f59fe1ae585543431a58f050cb8fe46<br>
<br>
Architecture independent packages:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.4_all.deb" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.7.10.4_all.deb</a><br>
Size/MD5: 4237110 8451e9872b23fc0f73ef16f384d4dddb<br>
<br>
Updated packages for Ubuntu 8.04 LTS:<br>
<br>
Source archives:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.4.dsc" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.4.dsc</a><br>
Size/MD5: 600 78f29ecb3d69baf5f529f15a06c41cf4<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.4.tar.gz" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.4.tar.gz</a><br>
Size/MD5: 8999068 d67755ccd109508c460a4a3a830d699d<br>
<br>
Architecture independent packages:<br>
<br>
<a href="http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.4_all.deb" target="_blank">http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist/openssl-blacklist_0.1-0ubuntu0.8.04.4_all.deb</a><br>
Size/MD5: 4236630 36f5d84a1cff08e86a6b1646565245e6<br>
<br>
<br>
<br>-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.6 (GNU/Linux)<br>
<br>
iD8DBQFINE5hW0JvuRdL8BoRAtJSAJ9axmJSnMH84okf6LJssr4s0VSydwCfcl+j<br>
PcRD8A4wCh5TOrYVIrHwqzY=<br>
=GlmK<br>
-----END PGP SIGNATURE-----<br>
<br>_______________________________________________<br>
Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/" target="_blank">http://secunia.com/</a><br></blockquote></div><br><br clear="all"><br>-- <br>Ganeshram Iyer<br>Open Source and CAD: <a href="http://ossandcad.blogspot.com">http://ossandcad.blogspot.com</a><br>
<a href="mailto:ganeshramiyer@yahoo.com">ganeshramiyer@yahoo.com</a>