Security experts have warned of a suspected vulnerability in the Debian and Ubuntu Linux operating systems.
Fortify Software confirmed the findings of a posting to the Debian security list last week, which detailed a critical vulnerability in the Open Secure Sockets Layer (SSL) packages within Debian and Ubuntu.
Fredrick Lee, a researcher at Fortify, claimed that the posting actually understates the potential seriousness of the flaw.
"We are calling this vulnerability 'insecure randomness' since it allows an attacker to predict the SSL cryptographic keys used for supposedly secure online transactions," he said.
Lee explained that a malicious user could intercept an ostensibly secure online banking session between a customer and their bank.
"What's worse is that our researchers calculate this flaw has been available to hackers for more than two years," he said.
The problem stems from a bug fix issued by Debian programmers that effectively "emasculates" the randomness engine required to ensure true security within the SSL module.
"Had we been contacted as part of the release strategy, as a number of other developers do, the flaw would have been immediately identified by our research team before the insecure update was released to the public," said Lee.
Two-year quality analysis studied 250 popular applications 20 May 2008
Taiwanese manufacturer will embed open source OS across entire range 16 May 2008
Novell-sponsored open source project gets 10 slots 16 May 2008A wake up call for open source developers, Gartner warns 28 May 2008
Company issues new update for QuickTime vulnerability 20 Sep 2007
Report claiming solar panels take over 100 years to recoup their value is just plain wrong, say manufacturers 05 Sep 2008
New hybrid hatchback designed to make dual-drive vehicles more affordable 05 Sep 2008
Republican attempts to highlight differences over energy policy as both candidates pledge to deliver US energy independence 05 Sep 2008
More news
Once your company has gathered up all the low-hanging fruit, what comes next? Sarah Fister Gale finds that the answer lies in everything from multi-million dollar energy efficiency programmes to printers powered by exercise bikes 03 Sep 2008
Slow journey times mean airships are highly unlikely to replace passenger jets, but, as Danny Bradbury discovers, a flotilla of new companies are convinced that low-fuel costs mean the old-fashioned aircraft could have huge appeal to freight operators 02 Sep 2008
Recent claims from the oil giant's chief executive suggesting tar sand extraction is required to slow the shift to coal may have caught the eye, but as BusinessGreen.com discovers they do not make much sense 28 Aug 2008 More in-depth
Post your comment
Send an email to the Business Green editor at feedback@businessgreen.com
