Frederick Lee, a researcher at insecurity company Fortify, said that the flaw, which affects Ubuntu as well as Debian, had been "seriously underestimated " as it makes the Secure Sockets Layer (SSL) of the two Linux sustems vulnerable to malicious attack.
"We're calling this vulnerability 'insecure randomness' since it allows an attacker to predict the SSL cryptographic keys used for supposedly secure online transactions," he said.
Lee reckons that the flaw, which tinkers with the randomness engine used to encrypt secure transactions, could be used to intercept traffic between a user and supposedly secure connection between a user and, for example, an online banking site.
Debian, Ubuntu flawed for two years
By
Stewart Meagher
on May 21, 2008 2:46PM
A research posting to the Debian security list last week has led to the confirmation of a serious hole in two flavours of the Open Source Linux operating system.
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
Promoted Content
From 30 people to 6 million: How workplace tech is driving Movember's global community
Promoted Content
Australian data sovereignty and protection concerns increase
Promoted Content
4 essentials for protecting data in the new normal
Promoted Content
COVID has sped up 'data gravity': how can IT leaders respond?
Sponsored Whitepapers
10 questions to ask before you select a Network Performance Management tool
Innovate faster. Why accelerating change is a CIO's biggest challenge.
Unlock faster time-to-revenue using Adobe digital document processes
How Security as Code changes development and deployment for the cloud
Tackle new ITSM priorities with this seven-step Micro Focus guide
