Slashdot Mirror

← Back to Stories (view on slashdot.org)

LibreSSL PRNG Vulnerability Patched

Posted by Soulskill on from the looking-forward-to-the-next-two-day-panic dept.

msm1267 writes: The OpenBSD project late last night rushed out a patch for a vulnerability in the LibreSSL pseudo random number generator (PRNG). The flaw was disclosed two days ago by the founder of secure backup company Opsmate, Andrew Ayer, who said the vulnerability was a "catastrophic failure of the PRNG." OpenBSD founder Theo de Raadt and developer Bob Beck, however, countered saying that the issue is "overblown" because Ayer's test program is unrealistic. Ayer's test program, when linked to LibreSSL and made two different calls to the PRNG, returned the exact same data both times.

"It is actually only a problem with the author's contrived test program," Beck said. "While it's a real issue, it's actually a fairly minor one, because real applications don't work the way the author describes, both because the PID (process identification number) issue would be very difficult to have become a real issue in real software, and nobody writes real software with OpenSSL the way the author has set this test up in the article."

6 of 151 comments (clear)

  1. This is not how you inspire confidence by Jonathan+C.+Patschke · · Score: 5, Insightful

    Q: What do we call "contrived test programs" in the "real" word?
    A: Exploits.

    --
    Pining for the days when The Glorious MEEPT!!! graced SlapDash with his wisdom.
    1. Re:This is not how you inspire confidence by viperidaenz · · Score: 4, Insightful

      Hang on, if you've already injected your own code on the system you want to exploit, why both trying to exploit the PRNG? You can do pretty much anything you want.

    2. Re:This is not how you inspire confidence by QuietLagoon · · Score: 4, Insightful
      The LibreSSL developers apparently agreed that it was a bug that should be fixed, and fix it they did.

      .
      The discussion seems to center more around whether or not this was a "catastrophic" bug, or a "minor" bug. A bug in a library that has not yet seen a production release. So one really should ask, why not just report the bug and have it fixed, instead of seeking headlines?

      There seem to be some people who would like to see the LibreSSL project fail. It makes one wonder why, as the OpenSSL near-monoculture has served the world so well.

  2. 'Vulnerability" is rubbish. by gnasher719 · · Score: 5, Insightful

    This is not a problem where an outside attacker can successfully attack the software. It is a problem where a malicious developer can attack his or her own software. So the vulnerability is not that an attacker can shoot at me with a gun, the vulnerability is that I can use my own gun to shoot myself in the foot. But only if I construct a clever framework that causes the anti-shoot-in-the-own-foot measures provided by the gun to be blocked.

  3. LibreSSL not ready for deployment yet by Kardos · · Score: 5, Insightful

    > The OpenBSD project late last night rushed out a patch ...

    Sensationalist introductory sentence. LibreSSL is is not used in any production environment, there is no "rush" here.

    It is an early version released to solicit feedback. Feedback was provided, resulting in a bug fix. This is *exactly* anticipated outcome.

  4. Re:You're holding the phone wrong by maliqua · · Score: 4, Insightful

    more like "I see your using the phone in a way we hadn't anticipated though we don't think thats the best way to use the phone we'll make the appropriate changes to ensure its safe for you to use in this manner"