August 22nd, 2008
Red Hat (belatedly) confirms security breach
More than a week after a cryptic note hinted at a security breach at Fedora, the open-source group has finally fessed up to two separate server intrusions that compromised the security of Red Hat’s OpenSSH packages.
The confirmation follows eight days of media speculation and conjecture over a brief e-mail that simply mentioned “an issue in the infrastructure systems” and calls into question Red Hat’s ability to promptly — and accurately — disclose security breaches.
Today’s acknowledgment is two-fold — an e-mail on the Fedora-Announce list and a critical Red Hat advisory — but some things surrounding the breach remain murky.
In the e-mail announcement, the group said some it discovered the breach “last week” but there’s no mention of when it actually occurred.
It said that one of the Fedora servers was a system used for signing Fedora packages but insists with “high confidence” that the intruder was not able to capture the passphrase used to secure the Fedora package signing key.
- Based on our review to date, the passphrase was not used during the time of the intrusion on the system and the passphrase is not stored on any of the Fedora servers.
- While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple
third-party mirrors and repositories, we have decided to convert to new Fedora signing keys. This may require affirmative steps from every Fedora system owner or administrator. We will widely and clearly communicate any such steps to help users when available.
In tandem with that announcement, Red Hat shipped a critical OpenSSH update to RHEL users that mentions an “an intrusion on certain computer system” that compromised some Open SSH packages.
- In connection with the incident, the intruder was able to sign a small number of OpenSSH packages relating only to Red Hat Enterprise Linux 4 (i386 and x86_64 architectures only) and Red Hat Enterprise Linux 5 (x86_64 architecture only). As a precautionary measure, we are releasing an updated version of these packages, and have published a list of the tampered packages and how to detect them at http://www.redhat.com/security/data/openssh-blacklist.html.
The company said its processes and efforts to date indicate that packages obtained by Red Hat Enterprise Linux subscribers via Red Hat Network are not at risk.
The company insists the effects of the intrusion on Fedora and Red Hat are not the same.
- Accordingly, the Fedora package signing key is not connected to, and is different from, the one used to sign Red Hat Enterprise Linux packages. Furthermore, the Fedora package signing key is also not connected to, and is different from, the one used to sign community Extra Packages for Enterprise Linux (EPEL) packages.
For daily updates on Ryan's activities, follow him on Twitter.
