oss-security - Security issue in reseed

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 06 Jul 2011 07:47:36 -0500
From: Jamie Strandboge <jamie@...onical.com>
To: Simon Dobson <simon.dobson@...tcd.ie>
Cc: oss-security@...ts.openwall.com, security@...ntu.com,
 security@...ian.org,  Jeffrey Walton <noloader@...il.com>
Subject: Security issue in reseed

A security bug was reported by Jeffrey Walton against reseed in
Ubuntu. You are being emailed as the upstream contact. Please keep
oss-security@...ts.openwall.com[1] CC'd for any updates on this issue.

This issue should be considered public. A CVE is being requested; please
mention this in any changelogs.

Details from the public bug follow:
https://launchpad.net/bugs/804594

From the reporter:
"reseed(8) performs an insecure HTTP fetch of data from random.org. The
script is automatically executed when installed, and any time the user
chooses to execute. In addition, the reseed man pages do not mention the
data is retrieved over an insecure channel."

As pointed out by the reporter, from the man page: "It is run once
during the installation of the package only". An attacker could perform
a MITM during package installation or whenever the reseed command is run
to provide predictable data for the random number seed.

Thanks in advance for your cooperation in coordinating a fix for this
issue,

Jamie Strandboge

[1] oss-security@...ts.openwall.com is a public mailing list for
    people to collaborate on security vulnerabilities and coordinate
    security updates.

-- 
Jamie Strandboge             | http://www.canonical.com

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.