libgcrypt CVE-2017-0379 Information Disclosure Vulnerability

Bugtraq ID:	100503
Class:	Design Error
CVE:	CVE-2017-0379
Remote:	No
Local:	Yes
Published:	Aug 27 2017 12:00AM
Updated:	Jan 16 2019 09:00AM
Credit:	NIIBE Yutaka
Vulnerable:	Oracle MySQL Workbench 8.0.11 Oracle Communications WebRTC Session Controller 7.1 Oracle Communications WebRTC Session Controller 7.0 Oracle Communications WebRTC Session Controller 0 Oracle Communications Interactive Session Recorder 6.0 Oracle Communications Interactive Session Recorder 5.0 GNU libgcrypt 0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Oracle Communications WebRTC Session Controller 7.2

libgcrypt CVE-2017-0379 Information Disclosure Vulnerability

libgcrypt is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

libgcrypt CVE-2017-0379 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libgcrypt CVE-2017-0379 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

libgcrypt CVE-2017-0379 Information Disclosure Vulnerability

References:

• Bug 1485921 - (CVE-2017-0379) CVE-2017-0379 libgcrypt: Missing input validation (Red Hat)
  
• CVE-2017-0379 (Red Hat)
  
• ecc: Add input validation for X25519 (Gnupg)
  
• Libgcrypt HomePage (Libgcrypt)
  
• Oracle Critical Patch Update Advisory - January 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2018 (Oracle)