Executive Summary
| Summary | |
|---|---|
| Title | libgcrypt20 security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-3650 | First vendor Publication | 2016-08-17 |
| Vendor | Debian | Last vendor Modification | 2016-08-17 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of Libgcrypt's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug for GnuPG shows that existing RSA keys are not weakened. For DSA and Elgamal keys it is also unlikely that the private key can be predicted from other public information. For the stable distribution (jessie), this problem has been fixed in version 1.6.3-2+deb8u2. We recommend that you upgrade your libgcrypt20 packages. |
Original Source
| Url : http://www.debian.org/security/2016/dsa-3650 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-200 | Information Exposure |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2018-08-17 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2017-0013.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing a security update. File : EulerOS_SA-2016-1081.nasl - Type : ACT_GATHER_INFO |
| 2016-12-05 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201612-01.nasl - Type : ACT_GATHER_INFO |
| 2016-11-15 | Name : The remote Fedora host is missing a security update. File : fedora_2016-b66a0aef08.nasl - Type : ACT_GATHER_INFO |
| 2016-11-15 | Name : The remote Fedora host is missing a security update. File : fedora_2016-aab0a156ab.nasl - Type : ACT_GATHER_INFO |
| 2016-11-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2674.nasl - Type : ACT_GATHER_INFO |
| 2016-11-09 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161108_libgcrypt_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2016-11-09 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0156.nasl - Type : ACT_GATHER_INFO |
| 2016-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2674.nasl - Type : ACT_GATHER_INFO |
| 2016-11-08 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2674.nasl - Type : ACT_GATHER_INFO |
| 2016-10-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201610-04.nasl - Type : ACT_GATHER_INFO |
| 2016-10-03 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1138.nasl - Type : ACT_GATHER_INFO |
| 2016-09-22 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2345-1.nasl - Type : ACT_GATHER_INFO |
| 2016-09-22 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2346-1.nasl - Type : ACT_GATHER_INFO |
| 2016-09-16 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-744.nasl - Type : ACT_GATHER_INFO |
| 2016-09-15 | Name : The remote Fedora host is missing a security update. File : fedora_2016-3a0195918f.nasl - Type : ACT_GATHER_INFO |
| 2016-09-08 | Name : The remote Fedora host is missing a security update. File : fedora_2016-2b4ecfa79f.nasl - Type : ACT_GATHER_INFO |
| 2016-09-01 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1042.nasl - Type : ACT_GATHER_INFO |
| 2016-08-30 | Name : The remote Debian host is missing a security update. File : debian_DLA-602.nasl - Type : ACT_GATHER_INFO |
| 2016-08-29 | Name : The remote Fedora host is missing a security update. File : fedora_2016-9864953aa3.nasl - Type : ACT_GATHER_INFO |
| 2016-08-24 | Name : The remote Debian host is missing a security update. File : debian_DLA-600.nasl - Type : ACT_GATHER_INFO |
| 2016-08-24 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-236-02.nasl - Type : ACT_GATHER_INFO |
| 2016-08-24 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-236-01.nasl - Type : ACT_GATHER_INFO |
| 2016-08-19 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3065-1.nasl - Type : ACT_GATHER_INFO |
| 2016-08-19 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3064-1.nasl - Type : ACT_GATHER_INFO |
| 2016-08-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3649.nasl - Type : ACT_GATHER_INFO |
| 2016-08-18 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_e1c71d8d64d911e6b38a25a46b33f2ed.nasl - Type : ACT_GATHER_INFO |
| 2016-08-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3650.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-12-17 00:24:23 |
|
| 2016-12-14 00:26:23 |
|
| 2016-08-19 13:25:15 |
|
| 2016-08-18 00:22:32 |
|
