PT-2014-1931 · Gnu+3 · Libgcrypt+3

Daniel Genkin + 2 · Publicado 2014-08-11 · Atualizado 2017-11-04 · CVE-2014-5270

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions libgcrypt versions prior to 1.5.4

Description The issue concerns the improper performance of ciphertext normalization and ciphertext randomization in libgcrypt, which can be exploited by physically proximate attackers to conduct key-extraction attacks. This is achieved by collecting voltage data from exposed metal, representing a different attack vector. The vulnerability can lead to a breach of confidentiality of protected information and can be exploited locally.

Recommendations For libgcrypt versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2014-1992

BDU:2015-09792

CVE-2014-5270

DLA-54-1

DLA-93-1

DSA-3024-1

DSA-3073-1

MGASA-2014-0365

MGASA-2014-0381

SUSE-SU-2014_1077-1

USN-2339-1

USN-2339-2

USN-2554-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Libgcrypt

Referências · 45

• https://bdu.fstec.ru/vul/2019-01635 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2014-5270 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0381 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3591 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5270 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-2554-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0381.html · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2014-5270 · Nota
• http://security.gentoo.org/glsa/glsa-201408-10.xml · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-5270 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-2339-2 · Aviso do Fabricante
• http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5270 · Aviso do Fabricante