The remote host is affected by the vulnerability described in GLSA-201402-24 (GnuPG, Libgcrypt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt.
      Please review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the user running GnuPG, cause a Denial of Service       condition, or bypass security restrictions. Additionally, a side-channel       attack may allow a local attacker to recover a private key, please review       &ldquo;Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel       Attack&rdquo; in the References section for further details.
  Workaround :

    There is no known workaround at this time.

Yarom and Falkner discovered that RSA secret keys could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system.

This update fixes this issue for the 1.4 series of GnuPG. GnuPG 2.x is affected through its use of the libgcrypt11 library, a fix for which will be published in DSA 2731.

Minor update from upstream fixing a moderate impact security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New gnupg and libgcrypt packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue.
New libgpg-error packages are also available for Slackware 13.1 and older as the supplied version wasn't new enough to compile the fixed version of libgcrypt.

Werner Koch of the GNU project reports :

Noteworthy changes in version 1.5.3 :

Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...

Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG 1.4.14.

The remote Solaris system is missing necessary patches to address security updates :

  - GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used     in GnuPG 2.0.x and possibly other products, allows local     users to obtain private RSA keys via a cache     side-channel attack involving the L3 cache, aka     Flush+Reload. (CVE-2013-4242)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2013-4242 GnuPG/libgcrypt susceptible to cache     side-channel attack

  - Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-002:01 advisory.

    Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a     development version.
    Security issues fixed with this release:
    CVE-2013-4242     GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows     local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka     Flush+Reload.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix for CVE-2013-4242

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of libgcrypt mitigates the Yarom/Falkner flush+reload side-channel attack on RSA secret keys. (CVE-2013-4242)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1457 advisory.

    - fix CVE-2013-4242 GnuPG/libgcrypt susceptible to cache side-channel attack

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2013-1458 advisory.

    - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted
    - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
    - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack
    - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
72638	GLSA-201402-24 : GnuPG, Libgcrypt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/2/23	2021/1/6	medium
69108	Debian DSA-2730-1 : gnupg - information leak	Nessus	Debian Local Security Checks	2013/7/30	2021/1/11	low
69186	Fedora 18 : libgcrypt-1.5.3-1.fc18 (2013-13671)	Nessus	Fedora Local Security Checks	2013/8/2	2021/1/11	low
69196	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : gnupg / libgcrypt (SSA:2013-215-01)	Nessus	Slackware Local Security Checks	2013/8/5	2021/1/14	low
69396	FreeBSD : GnuPG and Libgcrypt -- side-channel attack vulnerability (689c2bf7-0701-11e3-9a25-002590860428)	Nessus	FreeBSD Local Security Checks	2013/8/20	2021/1/6	low
80671	Oracle Solaris Third-Party Patch Update : libgcrypt (cve_2013_4242_information_disclosure)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	low
91744	OracleVM 3.2 : libgcrypt (OVMSA-2016-0062)	Nessus	OracleVM Local Security Checks	2016/6/22	2021/1/4	low
289631	MiracleLinux 4 : libgcrypt-1.4.5-11.AXS4 (AXSA:2014-002:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
69356	Fedora 18 : gnupg-1.4.14-1.fc18 (2013-13940)	Nessus	Fedora Local Security Checks	2013/8/15	2021/1/11	low
69374	SuSE 11.2 / 11.3 Security Update : libgcrypt (SAT Patch Numbers 8201 / 8202)	Nessus	SuSE Local Security Checks	2013/8/16	2021/1/19	low
70596	Oracle Linux 5 / 6 : libgcrypt (ELSA-2013-1457)	Nessus	Oracle Linux Local Security Checks	2013/10/25	2024/10/22	critical
70597	Oracle Linux 5 : gnupg (ELSA-2013-1458)	Nessus	Oracle Linux Local Security Checks	2013/10/25	2024/10/22	critical

检测

插件搜索

medium

low

low

low

low

low

low

critical

low

low

critical

critical