OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG’s algorithm is not cryptographically strong.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | 0.9.8c-1 (including) | 0.9.8g (including) |
| Openssh | Ubuntu | dapper | * |
| Openssh | Ubuntu | feisty | * |
| Openssh | Ubuntu | gutsy | * |
| Openssh | Ubuntu | hardy | * |
| Openssh-blacklist | Ubuntu | dapper | * |
| Openssh-blacklist | Ubuntu | feisty | * |
| Openssh-blacklist | Ubuntu | gutsy | * |
| Openssh-blacklist | Ubuntu | hardy | * |
| Openssh-blacklist | Ubuntu | upstream | * |
| Openssl | Ubuntu | feisty | * |
| Openssl | Ubuntu | gutsy | * |
| Openssl | Ubuntu | hardy | * |
| Openssl-blacklist | Ubuntu | dapper | * |
| Openssl-blacklist | Ubuntu | feisty | * |
| Openssl-blacklist | Ubuntu | gutsy | * |
| Openssl-blacklist | Ubuntu | hardy | * |
| Openssl-blacklist | Ubuntu | upstream | * |
| Openvpn | Ubuntu | feisty | * |
| Openvpn | Ubuntu | gutsy | * |
| Openvpn | Ubuntu | hardy | * |
| Openvpn-blacklist | Ubuntu | feisty | * |
| Openvpn-blacklist | Ubuntu | gutsy | * |
| Openvpn-blacklist | Ubuntu | hardy | * |
| Openvpn-blacklist | Ubuntu | upstream | * |
| Ssl-cert | Ubuntu | feisty | * |
| Ssl-cert | Ubuntu | gutsy | * |
| Ssl-cert | Ubuntu | hardy | * |
When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks. Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.