debian screwed up and modified something they shouldn’t have. The OpenSSL Project itself does not have the bug nor does any non-debian based system.
bookmark
Here is the slashdot thread about this from two weeks ago.
http://it.slashdot.org/article.pl?sid=08/05/13/1533212
The bug is limited to Debian and Ubuntu systems. One problem is that Linux is widely used in web server systems