Update your Debian generated keys/certs ASAP

Ojo con esto usuarios de Ubuntu o basados en Debian.

http://isc.incidents.org/diary.html?storyid=4421

INFOCon yellow: update your Debian generated keys/certs
ASAP<diary.html?storyid=4421>
Published: 2008-05-15,
Last Updated: 2008-05-15 23:16:38 UTC
by Bojan Zdrnja (Version: 3)

As you can see, we raised the INFOCon level to yellow. The main idea behind
INFOCon is to protect the Internet infrastructure at large, and the
development on automated scripts exploiting key based SSH authentication
looks like a real threat to SSH servers around the world (any SSH server
using public keys that were generated on a vulnerable Debian machine –
meaning – the keys had to be generated on a Debian machine between September
2006 and 13th of May 2008).

Note: 'Debian' in the above paragraph refers to any Debian-based Linux
distribution including Ubuntu.

Scripts that allow brute forcing of vulnerable keys (see this as rainbow
tables for SSH keys) are in the wild so we would like to remind all of you
to regenerate SSH keys ASAP.

Please keep in mind that SSL certificates should be regenerated as well.
This can be even more problematic if you had your certificates signed since
you'll have to go through this process again (and possibly pay money again).

Update 2310 UTC: The new Debian package for SSH (ssh_4.3p2-9etch1) also
applies a package called  "openssh-blacklist".  After this update, your  SSH
server will refuse  keys from the compromised set.  The package also
installs a new tool called "ssh-vulnkey" that can help in hunting down key
files that contain weak keys.   Note that in combination with the existing
ssh-keyscan, ssh-vulnkey can be used to easily identify servers that use
weak host keys, so while these Debian patches help those who patch, they
also make attacks easier against those who did not yet patch.

More information is available in our previous diaries:

http://isc.sans.org/diary.html?storyid=4420

http://isc.sans.org/diary.html?storyid=4414
 Keywords: debian </tag.html?tag=debian> openssh </tag.html?tag=openssh>
openssl </tag.html?tag=openssl> prng </tag.html?tag=prng>

Saludos,

ErIc...