Vulnerabilities > CVE-2015-0837 - Information Exposure Through Discrepancy vulnerability in multiple products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Huawei Local Security Checks NASL id EULEROS_SA-2020-1114.NASL description According to the version of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a last seen 2020-05-06 modified 2020-02-24 plugin id 133915 published 2020-02-24 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133915 title EulerOS 2.0 SP5 : libgcrypt (EulerOS-SA-2020-1114) NASL family Fedora Local Security Checks NASL id FEDORA_2015-3253.NASL description New upstream v1.4.19 Use ciphertext blinding for Elgamal decryption [CVE-2014-3591] Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837] Add AUTOPOINT=true to autoreconf so that it will build with gettext 0.18.x Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-17 plugin id 81858 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81858 title Fedora 20 : gnupg-1.4.19-2.fc20 (2015-3253) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2555-1.NASL description Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2014-3591) Daniel Genkin, Adi Shamir, and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2015-0837). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 82527 published 2015-04-02 reporter Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82527 title Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS / 14.10 : libgcrypt11, libgcrypt20 vulnerabilities (USN-2555-1) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2554-1.NASL description Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered that GnuPG was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2014-3591) Daniel Genkin, Adi Shamir, and Eran Tromer discovered that GnuPG was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2015-0837) Hanno Bock discovered that GnuPG incorrectly handled certain malformed keyrings. If a user or automated system were tricked into opening a malformed keyring, a remote attacker could use this issue to cause GnuPG to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-1606, CVE-2015-1607) In addition, this update improves GnuPG security by validating that the keys returned by keyservers match those requested. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 82526 published 2015-04-02 reporter Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82526 title Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS / 14.10 : gnupg, gnupg2 vulnerabilities (USN-2554-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-1511-1.NASL description This update fixes the following issues : Security : - Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical] (bsc#920057) Bugfixes : - don last seen 2020-06-01 modified 2020-06-02 plugin id 85871 published 2015-09-09 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85871 title SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2015:1511-1) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3184.NASL description Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard : - CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University. Ciphertext blinding was enabled to counteract it. Note that this may have a quite noticeable impact on Elgamal decryption performance. - CVE-2015-0837 The modular exponentiation routine mpi_powm() was susceptible to a side-channel attack caused by data-dependent timing variations when accessing its internal pre-computed table. - CVE-2015-1606 The keyring parsing code did not properly reject certain packet types not belonging in a keyring, which caused an access to memory already freed. This could allow remote attackers to cause a denial of service (crash) via crafted keyring files. last seen 2020-03-17 modified 2015-03-13 plugin id 81794 published 2015-03-13 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81794 title Debian DSA-3184-1 : gnupg - security update NASL family Fedora Local Security Checks NASL id FEDORA_2015-6881.NASL description Update to 1.6.3 which fixes CVE-2014-3591 CVE-2015-0837 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-05-05 plugin id 83239 published 2015-05-05 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/83239 title Fedora 21 : mingw-libgcrypt-1.6.3-1.fc21 (2015-6881) NASL family Fedora Local Security Checks NASL id FEDORA_2015-6868.NASL description Update to 1.6.3 which fixes CVE-2014-3591 CVE-2015-0837 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-05-04 plugin id 83213 published 2015-05-04 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/83213 title Fedora 22 : mingw-libgcrypt-1.6.3-1.fc22 (2015-6868) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2020-1498.NASL description According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.(CVE-2014-5270) - libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.(CVE-2017-7526) - Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server last seen 2020-04-30 modified 2020-04-16 plugin id 135660 published 2020-04-16 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/135660 title EulerOS Virtualization 3.0.2.2 : libgcrypt (EulerOS-SA-2020-1498) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201606-04.NASL description The remote host is affected by the vulnerability described in GLSA-201606-04 (GnuPG: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GnuPG and libgcrypt, please review the CVE identifiers referenced below for details. Impact : A local attacker could possibly cause a Denial of Service condition. Side-channel attacks could be leveraged to obtain key material. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 91481 published 2016-06-06 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/91481 title GLSA-201606-04 : GnuPG: Multiple vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-155.NASL description Updated gnupg and libgcrypt packages fix security vulnerabilities : GnuPG before 1.4.19 is vulnerable to a side-channel attack which can potentially lead to an information leak (CVE-2014-3591). GnuPG before 1.4.19 is vulnerable to a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak (CVE-2015-0837). The gnupg package has been patched to correct these issues. GnuPG2 is vulnerable to these issues through the libgcrypt library. The issues were fixed in libgcrypt 1.6.3. The libgcrypt package in Mandriva, at version 1.5.4, was only vulnerable to the CVE-2014-3591 issue. It has also been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 82408 published 2015-03-30 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82408 title Mandriva Linux Security Advisory : gnupg (MDVSA-2015:155) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201610-04.NASL description The remote host is affected by the vulnerability described in GLSA-201610-04 (libgcrypt: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libgcrypt. Please review the CVE identifiers referenced below for details. Impact : Side-channel attacks can leak private key information. A separate critical bug allows an attacker who obtains 4640 bits from the RNG to trivially predict the next 160 bits of output. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 93946 published 2016-10-11 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/93946 title GLSA-201610-04 : libgcrypt: Multiple vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2015-3489.NASL description New upstream release fixing two minor security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-19 plugin id 81930 published 2015-03-19 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81930 title Fedora 21 : libgcrypt-1.6.3-1.fc21 (2015-3489) NASL family Fedora Local Security Checks NASL id FEDORA_2015-2872.NASL description New upstream v1.4.19 - Use ciphertext blinding for Elgamal decryption [CVE-2014-3591] - Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837] Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-17 plugin id 81843 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81843 title Fedora 22 : gnupg-1.4.19-1.fc22 (2015-2872) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-190.NASL description Multiple vulnerabilities were discovered in libgcrypt : CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University. Ciphertext blinding was enabled to counteract it. Note that this may have a quite noticeable impact on Elgamal decryption performance. CVE-2015-0837 The modular exponentiation routine mpi_powm() was susceptible to a side-channel attack caused by data-dependent timing variations when accessing its internal pre-computed table. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-04-10 plugin id 82668 published 2015-04-10 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82668 title Debian DLA-190-1 : libgcrypt11 security update NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2015-577.NASL description Fix a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak. (CVE-2015-0837) Fix a side-channel attack which can potentially lead to an information leak. (CVE-2014-3591) Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576 , which was fixed in ALAS-2014-278. (CVE-2014-5270) last seen 2020-06-01 modified 2020-06-02 plugin id 85232 published 2015-08-05 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85232 title Amazon Linux AMI : libgcrypt (ALAS-2015-577) NASL family Fedora Local Security Checks NASL id FEDORA_2015-2893.NASL description New upstream v1.4.19 - Use ciphertext blinding for Elgamal decryption [CVE-2014-3591] - Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837] Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-09 plugin id 81681 published 2015-03-09 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81681 title Fedora 21 : gnupg-1.4.19-1.fc21 (2015-2893) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2020-1571.NASL description According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - ** DISPUTED ** The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating last seen 2020-05-08 modified 2020-05-01 plugin id 136274 published 2020-05-01 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/136274 title EulerOS Virtualization for ARM 64 3.0.2.0 : libgcrypt (EulerOS-SA-2020-1571) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2020-1400.NASL description According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server last seen 2020-05-06 modified 2020-04-15 plugin id 135529 published 2020-04-15 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/135529 title EulerOS 2.0 SP3 : libgcrypt (EulerOS-SA-2020-1400) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-175.NASL description Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard : CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University. Ciphertext blinding was enabled to counteract it. Note that this may have a quite noticeable impact on Elgamal decryption performance. CVE-2015-0837 The modular exponentiation routine mpi_powm() was susceptible to a side-channel attack caused by data-dependent timing variations when accessing its internal pre-computed table. CVE-2015-1606 The keyring parsing code did not properly reject certain packet types not belonging in a keyring, which caused an access to memory already freed. This could allow remote attackers to cause a denial of service (crash) via crafted keyring files. For the oldstable distribution (squeeze), those problems have been fixed in version 1.4.10-4+squeeze7. For the stable distribution (wheezy), these problems have been fixed in version 1.4.12-7+deb7u7. We recommend that you upgrade your gnupg packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-03-26 plugin id 82160 published 2015-03-26 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82160 title Debian DLA-175-1 : gnupg security update NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-154.NASL description Updated gnupg, gnupg2 and libgcrypt packages fix security vulnerabilities : GnuPG versions before 1.4.17 and 2.0.24 are vulnerable to a denial of service which can be caused by garbled compressed data packets which may put gpg into an infinite loop (CVE-2014-4617). The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack (CVE-2014-5270). GnuPG before 1.4.19 is vulnerable to a side-channel attack which can potentially lead to an information leak (CVE-2014-3591). GnuPG before 1.4.19 is vulnerable to a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak (CVE-2015-0837). The gnupg and gnupg2 package has been patched to correct these issues. GnuPG2 is vulnerable to these issues through the libgcrypt library. The issues were fixed in libgcrypt 1.6.3. The libgcrypt package in Mandriva, at version 1.5.4, was only vulnerable to the CVE-2014-3591 issue. It has also been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 82407 published 2015-03-30 reporter This script is Copyright (C) 2015-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82407 title Mandriva Linux Security Advisory : gnupg (MDVSA-2015:154) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2015-111-02.NASL description New gnupg packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 82915 published 2015-04-22 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82915 title Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : gnupg (SSA:2015-111-02) NASL family Fedora Local Security Checks NASL id FEDORA_2015-3399.NASL description New upstream release fixing two minor security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-17 plugin id 81861 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81861 title Fedora 22 : libgcrypt-1.6.3-1.fc22 (2015-3399) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-1626-1.NASL description This update fixes the following issues : - Use ciphertext blinding for Elgamal decryption [CVE-2014-3591]. See http://www.cs.tau.ac.il/~tromer/radioexp/ for details. (bsc#920057) - Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 86143 published 2015-09-25 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/86143 title SUSE SLED11 / SLES11 Security Update : libgcrypt (SUSE-SU-2015:1626-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-566.NASL description This update fixes two security vulnerabilities (bsc#920057) : - Use ciphertext blinding for Elgamal decryption [CVE-2014-3591]. See http://www.cs.tau.ac.il/~tromer/radioexp/ for details. - Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical] last seen 2020-06-05 modified 2015-09-08 plugin id 85835 published 2015-09-08 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85835 title openSUSE Security Update : libgcrypt (openSUSE-2015-566) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3185.NASL description Multiple vulnerabilities were discovered in libgcrypt : - CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University. Ciphertext blinding was enabled to counteract it. Note that this may have a quite noticeable impact on Elgamal decryption performance. - CVE-2015-0837 The modular exponentiation routine mpi_powm() was susceptible to a side-channel attack caused by data-dependent timing variations when accessing its internal pre-computed table. last seen 2020-03-17 modified 2015-03-13 plugin id 81795 published 2015-03-13 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81795 title Debian DSA-3185-1 : libgcrypt11 - security update