Security experts have warned of a suspected vulnerability in the Debian and Ubuntu Linux operating systems.
Fortify Software confirmed the findings of a posting to the Debian security list last week, which detailed a critical vulnerability in the Open Secure Sockets Layer (SSL) packages within Debian and Ubuntu.
Fredrick Lee, a researcher at Fortify, claimed that the posting actually understates the potential seriousness of the flaw.
"We are calling this vulnerability 'insecure randomness' since it allows an attacker to predict the SSL cryptographic keys used for supposedly secure online transactions," he said.
Lee explained that a malicious user could intercept an ostensibly secure online banking session between a customer and their bank.
"What's worse is that our researchers calculate this flaw has been available to hackers for more than two years," he said.
The problem stems from a bug fix issued by Debian programmers that effectively "emasculates" the randomness engine required to ensure true security within the SSL module.
"Had we been contacted as part of the release strategy, as a number of other developers do, the flaw would have been immediately identified by our research team before the insecure update was released to the public," said Lee.
Two-year quality analysis studied 250 popular applications 20 May 2008
Taiwanese manufacturer will embed open source OS across entire range 16 May 2008
Novell-sponsored open source project gets 10 slots 16 May 2008A wake up call for open source developers, Gartner warns 28 May 2008
Oklahoma leaves sensitive information in public domain for three years 22 Apr 2008
Vulnerability confirmed in Windows 2000, but could also be present in XP 13 Nov 2007
Phil Woolas practices what he preaches 23 Jul 2008
T Boone Pickens urges Senate to embrace plan to generate more than a fifth of US energy from wind 23 Jul 2008
New Combined Heat and Power plant to provide carbon netural energy to distribution centre 23 Jul 2008
More news
When faced with NGO criticism over their environmental performance, many firms simply batten down the hatches. But, as Paul Thomas argues, communicating with your detractors represents the best means of minimising brand damage 23 Jul 2008
Tom Whitehouse, chief executive of green PR consultancy Carbon International, offers tips on how green business startups can best attract investment 21 Jul 2008
Every business seems to want a green label or quality mark, but with so many certification schemes now available which one should they choose? Tilde Herrera investigates 18 Jul 2008 More in-depth
Post your comment
Send an email to the Business Green editor at feedback@businessgreen.com
