Ubuntu Security Notice (C) 2008-2016 Canonical, Inc. / NASL script (C) 2008-2016 Tenable Network Security, Inc.
The remote Ubuntu host is missing a security-related patch.
USN-612-3 addressed a weakness in OpenSSL certificate and key
generation in OpenVPN by introducing openssl-blacklist to aid in
detecting vulnerable private keys. This update enhances the
openssl-vulnkey tool to check X.509 certificates as well, and provides
the corresponding update for Ubuntu 6.06. While the OpenSSL in Ubuntu
6.06 was not vulnerable, openssl-blacklist is now provided for Ubuntu
6.06 for checking certificates and keys that may have been imported on
This update also includes the complete RSA-1024 and RSA-2048
blacklists for all Ubuntu architectures, as well as support for other
future blacklists for non-standard bit lengths.
You can check for weak SSL/TLS certificates by installing
openssl-blacklist via your package manager, and using the
$ openssl-vulnkey /path/to/certificate_or_key
This command can be used on public certificates and private keys for
any X.509 certificate or RSA key, including ones for web servers, mail
servers, OpenVPN, and others. If in doubt, destroy the certificate and
key and generate new ones. Please consult the documentation for your
software when recreating SSL/TLS certificates. Also, if certificates
have been generated for use on other systems, they must be found and
replaced as well.
A weakness has been discovered in the random number generator used by
OpenSSL on Debian and Ubuntu systems. As a result of this weakness,
certain encryption keys are much more common than they should be, such
that an attacker could guess the key through a brute-force attack
given minimal knowledge of the system. This particularly affects the
use of encryption keys in OpenSSH, OpenVPN and SSL certificates.
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Update the affected openssl-blacklist package.
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 6.2
Public Exploit Available : true