Reject vulnerable keys to mitigate Debian OpenSSL flaw

In 2008, Debian (and derived distributions such as Ubuntu) shipped an
OpenSSL package with a flawed random number generator, causing OpenSSH to
generate only a very limited set of keys which were subject to private half
precomputation.  To mitigate this, this patch checks key authentications
against a blacklist of known-vulnerable keys, and adds a new ssh-vulnkey
program which can be used to explicitly check keys against that blacklist.
See CVE-2008-0166.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469
Last-Update: 2013-09-14

Patch-Name: ssh-vulnkey.patch

1 files changed, 5 insertions, 0 deletions

diff --git a/sshd.c b/sshd.c
index e5c983514..fbe3284a9 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1688,6 +1688,11 @@ main(int ac, char **av)
                         sensitive_data.host_pubkeys[i] = NULL;
                         continue;
                 }
+                if (auth_key_is_revoked(key != NULL ? key : pubkey, 1)) {
+                        sensitive_data.host_keys[i] = NULL;
+                        sensitive_data.host_pubkeys[i] = NULL;
+                        continue;
+                }
 
                 switch (keytype) {
                 case KEY_RSA1: