OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

From: Florian Weimer (fwdeneb.enyo.de)
Date: Thu May 22 2008 - 16:32:39 CDT

* Asterisk Security Team:

> +------------------------------------------------------------------------+
> | Resolution | Since this is not a vulnerability in Asterisk itself but |
> | | in a tool that Asterisk uses, there will be no new |
> | | releases made; however, users who are affected by the |
> | | Debian OpenSSL vulnerability are strongly encouraged to |
> | | upgrade their package of OpenSSL to an uncompromised |
> | | version (version 0.9.8c-4 or later) and regenerate all |
> | | keys used by Asterisk. |
> +------------------------------------------------------------------------+

Correction: The first fixed version are 0.9.8c-4etch3 (on the
etch/stable branch) and 0.9.8g-9 (for sid/unstable and lenny/testing).
Plain 0.9.8c-4 (and 0.9.8c-4etch1 and 0.9.8c-4etch2) are vulnerable.