[arch-security] [ASA-201609-14] lib32-libgcrypt: information disclosure
rgacogne at archlinux.org
Sat Sep 17 21:04:15 UTC 2016
Arch Linux Security Advisory ASA-201609-14
Date : 2016-09-17
CVE-ID : CVE-2016-6313
Package : lib32-libgcrypt
Type : information disclosure
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package lib32-libgcrypt before version 1.7.3-1 is vulnerable to
Upgrade to 1.7.3-1.
# pacman -Syu "lib32-libgcrypt>=1.7.3-1"
The problem has been fixed upstream in version 1.7.3.
Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of
Technology found a bug in the mixing functions of Libgcrypt's random
number generator: An attacker who obtains 4640 bits from the RNG can
trivially predict the next 160 bits of output. This bug exists since
1998 in all GnuPG and Libgcrypt versions.
A remote attacker, given access to enough entropy previously generated
from the RNG, can predict its output. Such access to enough entropy has
been found to be very unlikely in most situations, even for a local
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security