From martin.pitt@canonical.com Fri Sep 9 11:19:12 2005 From: Martin Pitt To: ubuntu-security-announce@lists.ubuntu.com Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com Date: Fri, 9 Sep 2005 17:18:00 +0200 Subject: [Full-disclosure] [USN-179-1] openssl weak default configuration =========================================================== Ubuntu Security Notice USN-179-1 September 09, 2005 openssl weak default configuration https://bugzilla.ubuntu.com/show_bug.cgi?id=13593 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: openssl The problem can be corrected by upgrading the affected package to version 0.9.7d-3ubuntu0.2 (for Ubuntu 4.10), or 0.9.7e-3ubuntu0.1 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: The current default algorithm for creating "message digests" (electronic signatures) for certificates created by openssl is MD5. However, this algorithm is not deemed secure any more, and some practical attacks have been demonstrated which could allow an attacker to forge certificates with a valid certification authority signature even if he does not know the secret CA signing key. Therefore all Ubuntu versions of openssl have now been changed to use SHA-1 by default. This is a more appropriate default algorithm for the majority of use cases; however, if you still want to use MD5 as default, you can revert this change by changing the two instances of "default_md = sha1" to "default_md = md5" in /etc/ssl/openssl.cnf. A detailed explanation and further links can be found at http://www.cits.rub.de/MD5Collisions/ Updated packages for Ubuntu 4.10 (Warty Warthog): Source archives: http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7d-3ubuntu0.2.diff.gz Size/MD5: 25934 e06a4ebe002f3a43dc492cee46149b45 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7d-3ubuntu0.2.dsc Size/MD5: 636 e11f5f6231d05e17c11bac60c7765e94 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7d.orig.tar.gz Size/MD5: 2799796 533b7f758325d74c1e01e67994e3ae59 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7d-3ubuntu0.2_amd64.deb Size/MD5: 2676640 3be830e4beb6e40089bcb5bbcffc2e07 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7d-3ubuntu0.2_amd64.deb Size/MD5: 696986 4acada3a47b8116c38beae46f1472888 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7d-3ubuntu0.2_amd64.deb Size/MD5: 899782 9e728d2ced98a1b297fe5e5e70e2f501 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7d-3ubuntu0.2_i386.deb Size/MD5: 2477468 fc2944d39c6c5fb5117d4909b83cde83 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7d-3ubuntu0.2_i386.deb Size/MD5: 2152990 d09ac9e5901cc196da053c61a185e4ca http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7d-3ubuntu0.2_i386.deb Size/MD5: 898444 ad35e5b298aee3479b9d4fdc209e3661 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7d-3ubuntu0.2_powerpc.deb Size/MD5: 2759030 283074e7ade479e381c7acf7e207bba1 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7d-3ubuntu0.2_powerpc.deb Size/MD5: 700766 69ca323a46256db250d12f325e140d59 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7d-3ubuntu0.2_powerpc.deb Size/MD5: 904396 10d8f1e257a00fba6b105391b4cd182f Updated packages for Ubuntu 5.04 (Hoary Hedgehog): Source archives: http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.1.diff.gz Size/MD5: 28446 1aea4eb1e8ca811bac6bf974c88d86f6 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.1.dsc Size/MD5: 645 660479043ea6c45155d371594be8af24 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e.orig.tar.gz Size/MD5: 3043231 a8777164bca38d84e5eb2b1535223474 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.1_amd64.udeb Size/MD5: 495076 196e108273babe1ee2885ea5f18695eb http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.1_amd64.deb Size/MD5: 2693088 03204456f6f125c13d5b45bbf3135e1e http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.1_amd64.deb Size/MD5: 769306 cee881a42108c488362de1eecf1162f6 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.1_amd64.deb Size/MD5: 903308 50489fa878601993667582ee18193bee i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.1_i386.udeb Size/MD5: 433188 f0f38c4de6accc33a458069eceac813a http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.1_i386.deb Size/MD5: 2492176 46f6844494deeddd34a82212a4586b1d http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.1_i386.deb Size/MD5: 2240302 4bf0ff01a737f91d6987fbe189007e23 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.1_i386.deb Size/MD5: 900782 d5b985081049a1b0b71a23d3c0913c3b ia64 architecture (Intel Itanium) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.1_ia64.udeb Size/MD5: 713326 86db5ab5391417085fcf41e3b40de3fe http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.1_ia64.deb Size/MD5: 3395220 38ed3cd58d573774414137d24af74717 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.1_ia64.deb Size/MD5: 1037652 e4e04177f77cce913fcc96a9a457b64f http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.1_ia64.deb Size/MD5: 974696 10095ea31a51236d0e5c9a1cbad9b7cf powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.1_powerpc.udeb Size/MD5: 499308 72c6ee7cd7de757f534ff250b6228c2f http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.1_powerpc.deb Size/MD5: 2773772 d4cdb25892e6633e0630e8098167297d http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.1_powerpc.deb Size/MD5: 778940 5a5f3bb6d59e12e26c6f690079da6545 http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.1_powerpc.deb Size/MD5: 907796 19da07525a372f7bc760b545174a7f98 [ Part 1.2, "Digital signature" Application/PGP-SIGNATURE ] [ 196bytes. ] [ Unable to print this part. ] [ Part 2: "Attached Text" ] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/