PT-2014-1931 · Gnu+3 · Libgcrypt+3

Daniel Genkin + 2 · Published 2014-08-11 · Updated 2017-11-04 · CVE-2014-5270

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions libgcrypt versions prior to 1.5.4

Description The issue concerns the improper performance of ciphertext normalization and ciphertext randomization in libgcrypt, which can be exploited by physically proximate attackers to conduct key-extraction attacks. This is achieved by collecting voltage data from exposed metal, representing a different attack vector. The vulnerability can lead to a breach of confidentiality of protected information and can be exploited locally.

Recommendations For libgcrypt versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2014-1992

BDU:2015-09792

CVE-2014-5270

DLA-54-1

DLA-93-1

DSA-3024-1

DSA-3073-1

MGASA-2014-0365

MGASA-2014-0381

SUSE-SU-2014_1077-1

USN-2339-1

USN-2339-2

USN-2554-1

Affected Products

Alt Linux

Suse

Ubuntu

Libgcrypt

References · 45

• https://bdu.fstec.ru/vul/2019-01635 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-5270 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0381 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5270 · Security Note
• https://ubuntu.com/security/notices/USN-2554-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0381.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270 · Security Note
• https://osv.dev/vulnerability/CVE-2014-5270 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591 · Security Note
• https://ubuntu.com/security/notices/USN-2339-2 · Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5270 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2339-2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0365.html · Security Note