OpenSSH update

Releases

• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 7.04

Packages

• openssh -

Details

Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys
with options (such as “no-port-forwarding” or forced commands) were
ignored by the new ssh-vulnkey tool introduced in OpenSSH (see
USN-612-2). This could cause some compromised keys not to be
listed in ssh-vulnkey’s output.

This update also adds more information to ssh-vulnkey’s manual page.

Original advisory details:

A weakness has been discovered in the random number generator used
by OpenSSL on Debian and Ubuntu systems. As a result of this
weakness, certain encryption keys are much more common than they
should be, such that an attacker could guess the key through a
brute-force attack given minimal knowledge of the system. This
particularly affects the use of encryption keys in OpenSSH, OpenVPN
and SSL certificates.