Meddling in the affairs of dragons: Debian/Ubuntu OpenSSL PRNG flawed

Link: http://wiki.debian.org/SSLkeys

April 2006: OpenSSL pseudorandom number generation code throws valgrind error, and a bug report is filed.[1]

May 2006: New package is released and shipped.

* Don't add uninitialised data to the random number generator. This stop valgrind from giving error messages in unrelated code. (Closes: #363516)[2]

September 2006: Given a second chance to avoid a terrible fate, the bug fix is actually applied:

* Move the modified rand/md_rand.c file to the right place, really fixing #363516.[3]

May 2008: "WHAT THE FUCK... WHO... JESUS HOLY SHIT! OH GOD!"

http://lists.debian.org/debian-security-announce/2008/msg00152.html
https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-May/000705.html

Summary: Any Debian or Ubuntu or derivative system that has generated a key (including SSH host keys!!) within the past two years is... uhh... well, let's just say you're going to want to recreate those keys. Oh, and if you used DSA at all, sorry.

apt-get update && apt-get upgrade ('tho I needed to dist-upgrade due to the openssh-blacklist package being added) will fix your SSH situation under Ubuntu, up to and including regenerating your keys and rejecting connections using bad client keys. ssh-vulnkey can be used to check your authorized_keys. YMMV under Debian, etc. I don't personally use https or other SSL'd services on my Debian/Ubuntu machines at the moment, so I'm not sure how to fix that.

Other software advisories:

• Tor: update required for ALL 0.2.0.x users, key regeneration required for afflicted OpenSSL users

SpaceHobo sent along some additional information about how obvious the openssl-team mailing list is. Run, don't walk, to your music store to get Yakety Sax if you aren't already listening to it in your head.

This page has a lot of useful stuff: http://wiki.debian.org/SSLkeys I highly recommend a gander at it, as it generally has better information than this post.

edit: revise wording on apt-get update paragraph to mention that my knowledge is SSH-specific; added other software advisory section. added advogato link from spacehobo. added debian wiki link, made it the master link on this blog entry.