[USN-612-3] OpenVPN vulnerability

Tue May 13 18:56:23 UTC 2008

=========================================================== 
Ubuntu Security Notice USN-612-3               May 13, 2008
openvpn vulnerability
CVE-2008-0166, http://www.ubuntu.com/usn/usn-612-1
===========================================================

A weakness has been discovered in the random number generator used
by OpenSSL on Debian and Ubuntu systems.  As a result of this
weakness, certain encryption keys are much more common than they
should be, such that an attacker could guess the key through a
brute-force attack given minimal knowledge of the system.  This
particularly affects the use of shared encryption keys and SSL/TLS
certificates in OpenVPN.

This vulnerability only affects operating systems which (like
Ubuntu) are based on Debian.  However, other systems can be
indirectly affected if weak keys are imported into them.

We consider this an extremely serious vulnerability, and urge all
users to act immediately to secure their systems.

The following Ubuntu releases are affected: 

Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.04:
  openvpn                         2.0.9-5ubuntu0.1

Ubuntu 7.10:
  openvpn                         2.0.9-8ubuntu0.1

Ubuntu 8.04 LTS:
  openvpn                         2.1~rc7-1ubuntu3.1

Details follow:

   Once the update is applied, weak shared encryption keys and
   SSL/TLS certificates will be rejected where possible (though
   they cannot be detected in all cases). If you are using such
   keys or certificates, OpenVPN will not start and the keys or
   certificates will need to be regenerated.

   The safest course of action is to regenerate all OpenVPN
   certificates and key files, except where it can be established
   to a high degree of certainty that the certificate or shared key
   was generated on an unaffected system.

   Once the update is applied, you can check for weak OpenVPN shared
   secret keys with the openvpn-vulnkey command.

   $ openvpn-vulnkey /path/to/key

   OpenVPN shared keys can be regenerated using the openvpn command.

   $ openvpn --genkey --secret <file>

   Additionally, you can check for weak SSL/TLS certificates by
   installing openssl-blacklist via your package manager, and using
   the openssl-vulkey command.

   $ openssl-vulnkey /path/to/key

   Please note that openssl-vulnkey only checks RSA private keys
   with 1024 and 2048 bit lengths. If in doubt, destroy the
   certificate and/or key and generate a new one. Please consult the
   OpenVPN documention when recreating SSL/TLS certificates.

   Additionally, if certificates have been generated for use on other
   systems, they must be found and replaced as well.

Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.1.diff.gz
      Size/MD5:    60747 8a64cba41a38497fe25ef36afa3297a4
    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.1.dsc
      Size/MD5:      641 18586d5869fb67929f2330dba3730498
    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9.orig.tar.gz
      Size/MD5:   669076 60745008b90b7dbe25fe8337c550fec6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.1_amd64.deb
      Size/MD5:   356162 cff07c3dbbc6b56a4932d91b6049499e

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.1_i386.deb
      Size/MD5:   337190 2ece431df11236714da50fc28a63f238

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.1_powerpc.deb
      Size/MD5:   357868 b9877bc7840768f0002a8e8016e8401a

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-5ubuntu0.1_sparc.deb
      Size/MD5:   335978 8ff9625fb34f49e64cfb8811bb787b3a

Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1.diff.gz
      Size/MD5:    64195 02287a5ee333a17db50cb43c9d902433
    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1.dsc
      Size/MD5:      642 d2a6e3308144f656dbfd35526e944187
    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9.orig.tar.gz
      Size/MD5:   669076 60745008b90b7dbe25fe8337c550fec6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1_amd64.deb
      Size/MD5:   361852 19adb72a25cb5a4803bbc7e4b787d08f

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1_i386.deb
      Size/MD5:   341626 0fe67ae7eee3fd15900e78243dbec409

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1_lpia.deb
      Size/MD5:   343206 51f7d5738b58ce8315fee4cf9a6855cf

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1_powerpc.deb
      Size/MD5:   363094 1b3067714e8cc68a494715d39b2f0b63

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/universe/o/openvpn/openvpn_2.0.9-8ubuntu0.1_sparc.deb
      Size/MD5:   341314 6bf8aa1066a79f4f0a17750fa0376238

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1.diff.gz
      Size/MD5:    35191 c3c32ea1efcc83a0deb61f3adcfc1609
    http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1.dsc
      Size/MD5:      646 35a1021ae123a548cd57aeba15385b9e
    http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7.orig.tar.gz
      Size/MD5:   786288 dac8b5104b5eb105ba82b2525d371d58

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1_amd64.deb
      Size/MD5:   390828 537d1c0fba3fd2ea1853f2cd59df8c39

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1_i386.deb
      Size/MD5:   372070 402b12a2ba4b1aa706e6160fe4c4c18b

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1_lpia.deb
      Size/MD5:   371074 acf51c0ab94e0f8a052d8e16de01c918

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1_powerpc.deb
      Size/MD5:   391320 5315f5eda07a544d11c4ae415414f756

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/o/openvpn/openvpn_2.1~rc7-1ubuntu3.1_sparc.deb
      Size/MD5:   368786 96633aff8986fe2fedcbed30bb3090dd