A vulnerability has been reported in the Debian Linux use of the OpenSSL library. This vulnerability can lead to generation of insecure security keys that can be brute-force attacked. The problem affects the Debian version of the Linux operating system, as well as Debian-derived variants (such as Ubuntu).

Network Box Security Response has analysed the vulnerability, as well as our own version of the openssl library, and can confirm the following:

Neither the Network Box NBRS-1.1 nor NBRS-3.0 firmwares are derived from Debian, and the Network Box firmware (including openssl library) is not vulnerable to this issue. Keys issued by Network Box systems are secure.

The recommendation for users of Debian (or Debian-derived) systems affected by the vulnerability is to patch the operating system to protect future keys, and then to re-issue security keys to avoid the possibility of exploit.

Back