libgcrypt RSA Secret Keys Information Disclosure Vulnerability
BID:61464
Info
libgcrypt RSA Secret Keys Information Disclosure Vulnerability
| Bugtraq ID: | 61464 |
| Class: | Design Error |
| CVE: |
CVE-2013-4242 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 25 2013 12:00AM |
| Updated: | Jul 29 2016 05:01PM |
| Credit: | Yuval Yarom and Katrina Falkner |
| Vulnerable: |
Ubuntu Ubuntu Linux 13.04 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Slackware Linux x86_64 -current Slackware Linux 14.0 x86_64 Slackware Linux 14.0 Slackware Linux 13.37 x86_64 Slackware Linux 13.37 Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux -current Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle VM Server for x86 3.4 Oracle VM Server for x86 3.3 Oracle VM Server for x86 3.2 Oracle Solaris 11.1 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gnupg Gnupg 3.1.3 Gnupg Gnupg 2.0.16 Gnupg Gnupg 2.0.15 Gnupg Gnupg 2.0.14 Gnupg Gnupg 2.0.13 Gnupg Gnupg 2.0.11 Gnupg Gnupg 2.0.10 Gnupg Gnupg 2.0.8 Gnupg Gnupg 2.0.7 Gnupg Gnupg 1.9.20 Gnupg Gnupg 1.9.19 Gnupg Gnupg 1.9.17 Gnupg Gnupg 1.9.16 Gnupg Gnupg 1.5.2 Gnupg Gnupg 1.4.13 Gnupg Gnupg 1.4.12 Gnupg Gnupg 1.4.11 Gnupg Gnupg 1.4.10 Gnupg Gnupg 1.4.8 Gnupg Gnupg 1.4.5 Gnupg Gnupg 1.4.2 Gnupg Gnupg 1.3.6 Gnupg Gnupg 1.3.4 Gnupg Gnupg 1.3.3 Gnupg Gnupg 1.3.2 Gnupg Gnupg 1.2.7 Gnupg Gnupg 1.2.5 Gnupg Gnupg 1.2.4 Gnupg Gnupg 1.2.1 Gnupg Gnupg 1.1 Gnupg Gnupg 1.0.7 Gnupg Gnupg 1.0.6 Gnupg Gnupg 1.0.5 Gnupg Gnupg 1.0.4 Gnupg Gnupg 1.0.4 Gnupg Gnupg 1.0.2 Gnupg Gnupg 1.0.2 Gnupg Gnupg 0.9.11 Gnupg Gnupg 0.9.10 Gnupg Gnupg 0.9.9 Gnupg Gnupg 0.9.8 Gnupg Gnupg 0.9.7 Gnupg Gnupg 0.9.6 Gnupg Gnupg 0.9.5 Gnupg Gnupg 0.9.4 Gnupg Gnupg 0.9.4 Gnupg Gnupg 0.9.1 Gnupg Gnupg 0.9 Gnupg Gnupg 0.4.5 Gnupg Gnupg 0.4.4 Gnupg Gnupg 0.4.3 Gnupg Gnupg 0.4.1 Gnupg Gnupg 0.4 -beta 1 Gnupg Gnupg 0.3.5 Gnupg Gnupg 0.3.3 Gnupg Gnupg 0.3.2 Gnupg Gnupg 0.3 Gnupg Gnupg 0.3 Gnupg Gnupg 0.2.19 Gnupg Gnupg 0.2.18 Gnupg Gnupg 0.2.17 Gnupg Gnupg 0.2.16 Gnupg Gnupg 0.2.15 Gnupg Gnupg 2.0.6 Gnupg Gnupg 2.0.5 Gnupg Gnupg 2.0.3 Gnupg Gnupg 2.0.12 Gnupg Gnupg 2.0.1 Gnupg Gnupg 1.9.92 Gnupg Gnupg 1.4.4 Gnupg Gnupg 1.4.0 Gnupg Gnupg 1.3.93 Gnupg Gnupg 1.3.92 Gnupg Gnupg 1.3.91 Gnupg Gnupg 1.3.90 Gnupg Gnupg 1.3.1 Gnupg Gnupg 1.3.0 Gnupg Gnupg 1.2.6 Gnupg Gnupg 1.2.3 Gnupg Gnupg 1.2.2 Gnupg Gnupg 1.2.1 Windows Gnupg Gnupg 1.0.5 - Win32 Gnupg Gnupg 1.0.4 - Win32 Gnupg Gnupg 1.0.1 Gnupg Gnupg 0.9.3 Gnupg Gnupg 0.3.4 Gnupg Gnupg 0.0.0 - GNU libgcrypt 1.5.2 GNU libgcrypt 1.1.12 GNU libgcrypt 1.1.11 GNU libgcrypt 1.1.10 GNU libgcrypt 1.1.9 GNU libgcrypt 1.1.8 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Canonical Ubuntu Linux 10.04 - Lts Avaya Voice Portal 5.1.3 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP3 Avaya Voice Portal 5.1 SP2 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Proactive Contact 5.1 Avaya Proactive Contact 5.0 Avaya one-X Client Enablement Services 6.2 Avaya one-X Client Enablement Services 6.1.2 Avaya one-X Client Enablement Services 6.1.1 Avaya one-X Client Enablement Services 6.1 Avaya one-X Client Enablement Services 6.0 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya IP Office Server Edition 9.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 9.0 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya CMS r17 Avaya Aura System Platform 6.2.2 Avaya Aura System Platform 6.2.1 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.3 Avaya Aura System Platform 6.2.1.0.9 Avaya Aura System Platform 6.2 SP1 Avaya Aura System Platform 6.2 Avaya Aura System Platform 6.0.3.9.3 Avaya Aura System Platform 6.0.3.8.3 Avaya Aura System Platform 6.0.3.0.3 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.1 Avaya Aura System Platform 1.0 Avaya Aura System Manager 6.3.4 Avaya Aura System Manager 6.3.2 Avaya Aura System Manager 6.3.1 Avaya Aura System Manager 6.3 Avaya Aura System Manager 6.2.3 Avaya Aura System Manager 6.2 SP3 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.5 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura System Manager 5.0 Avaya Aura Session Manager 6.3.1 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.5 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.0.1 Avaya Aura Session Manager 6.3 Avaya Aura Session Manager 6.2.3 Avaya Aura Session Manager 6.2.2 Avaya Aura Session Manager 6.2 SP1 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0.2 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2.4 Avaya Aura Session Manager 5.2.1 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 5.0 Avaya Aura Presence Services 6.1.2 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.2 Avaya Aura Presence Services 6.1 SP2 Avaya Aura Presence Services 6.1 SP1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Presence Services 5.2 Avaya Aura Messaging 6.1.1 Avaya Aura Messaging 6.2 Avaya Aura Messaging 6.1 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0.2 Avaya Aura Experience Portal 6.0.1 Avaya Aura Experience Portal 6.0 SP2 Avaya Aura Experience Portal 6.0 SP1 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 7.0 Standard Avaya Aura Conferencing 7.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Communication Manager Utility Services 6.3 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.3 Avaya Aura Communication Manager 6.2 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Collaboration Environment 2.0 Avaya Aura Application Server 5300 SIP Core 3.0 Avaya Aura Application Server 5300 SIP Core 2.1 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.2 Avaya Aura Application Enablement Services 6.1.2 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 6.0 Avaya Aura Application Enablement Services 5.2.4 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 Avaya Aura Application Enablement Services 5.0 |
| Not Vulnerable: |
Oracle Solaris 11.1.18.5.0 Gnupg Gnupg 1.4.14 GNU libgcrypt 1.5.3 |
Discussion
libgcrypt RSA Secret Keys Information Disclosure Vulnerability
libgcrypt is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.
Versions prior to libgcrypt 1.5.3 are vulnerable.
libgcrypt is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.
Versions prior to libgcrypt 1.5.3 are vulnerable.
Exploit / POC
libgcrypt RSA Secret Keys Information Disclosure Vulnerability
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
libgcrypt RSA Secret Keys Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Slackware Linux 12.2
Slackware Linux 14.0 x86_64
MandrakeSoft Enterprise Server 5
Slackware Linux 13.37
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Slackware Linux 12.2
-
Slackware gnupg-1.4.14-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packagess /gnupg-1.4.14-i486-1_slack12.2.tgz -
Slackware libgcrypt-1.5.3-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packagess /libgcrypt-1.5.3-i486-1_slack12.2.tgz -
Slackware libgpg-error-1.11-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packagess /libgpg-error-1.11-i486-1_slack12.2.tgz
Slackware Linux 14.0 x86_64
-
Slackware gnupg-1.4.14-x86_64-1_slack14.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/package ss/gnupg-1.4.14-x86_64-1_slack14.0.txz -
Slackware libgcrypt-1.5.3-x86_64-1_slack14.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/package ss/libgcrypt-1.5.3-x86_64-1_slack14.0.txz
MandrakeSoft Enterprise Server 5
-
Mandriva gnupg-1.4.9-5.2mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libgcrypt-devel-1.4.1-2.1mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libgcrypt11-1.4.1-2.1mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/
Slackware Linux 13.37
-
Slackware gnupg-1.4.14-i486-1_slack13.37.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages s/gnupg-1.4.14-i486-1_slack13.37.txz -
Slackware libgcrypt-1.5.3-i486-1_slack13.37.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages s/libgcrypt-1.5.3-i486-1_slack13.37.txz
References
libgcrypt RSA Secret Keys Information Disclosure Vulnerability
References:
References:
- CVE request: GnuPG side-channel attack on RSA secret keys (Werner Koch)
- CVE-2013-4242 Information Disclosure vulnerability in libgcrypt (Oracle)
- Libgcrypt HomePage (Libgcrypt)
- libgcrypt security update (RHSA-2013-1457) (Avaya)
- gnupg security update (RHSA-2013-1458) (Avaya)
- L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel a (US-CERT)
- Oracle VM Server for x86 Bulletin - July 2016 (Oracle)