BugTraq
Ubuntu: reseed(8), random.org, and HTTP request Jul 06 2011 04:04AM
Jeffrey Walton (noloader gmail com) (3 replies)
Ubuntu's reseed(8) can be used to seed the PRNG state of a host. The
script is run when the package installed, and anytime su executes the
script.

reseed(8) performs a unsecured HTTP request to random.org for its
bits, despite random.org offering HTTPS services.

The Ubuntu Security Team took no interest when contacted by email (no
reply); the point of contact listed in the man pages took no interest
when contacted by email (no reply); and a launcher bug report was not
acted upon (https://bugs.launchpad.net/ubuntu/+source/reseed/+bug/804594).

[ reply ]
Re: [Full-disclosure] Ubuntu: reseed(8), random.org, and HTTP request Jul 06 2011 07:41PM
Michal Zalewski (lcamtuf coredump cx) (1 replies)
Re: [Full-disclosure] Ubuntu: reseed(8), random.org, and HTTP request Jul 06 2011 07:42PM
Michal Zalewski (lcamtuf coredump cx)
Re: [Full-disclosure] Ubuntu: reseed(8), random.org, and HTTP request Jul 06 2011 01:06PM
Jamie Strandboge (jamie canonical com)
Re: [Full-disclosure] Ubuntu: reseed(8), random.org, and HTTP request Jul 06 2011 07:23AM
coderman (coderman gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus