Serious security vulnerability on Debian/Ubuntu

[Piru]

Luciano Bello discovered that the random number generator in Debian's openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (CVE-2008-0166). As a result, cryptographic key material may be guessable.

...

Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key material for use in X.509 certificates and session keys used in SSL/TLS connections.

DSA-1571-1 openssl -- predictable random number generator
USN-612-2: OpenSSH vulnerability

[Piru]

More details about the vulnerability:

http://wiki.debian.org/SSLkeys
http://metasploit.com/users/hdm/tools/debian-openssl/

[Piru]

There fix is there already. The problem is that not everyone updates their boxes daily.