Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.

The remote host is affected by the vulnerability described in GLSA-201610-04 (libgcrypt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libgcrypt. Please       review the CVE identifiers referenced below for details.
  Impact :

    Side-channel attacks can leak private key information. A separate       critical bug allows an attacker who obtains 4640 bits from the RNG to       trivially predict the next 160 bits of output.
  Workaround :

    There is no known workaround at this time.

New upstream release fixing CVE-2015-7511 low impact security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libgcrypt was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-7511: Side-channel attack on ECDH with     Weierstrass curves (bsc#965902).

    This update was imported from the SUSE:SLE-12:Update     update project.

libgcrypt was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-7511: Side-channel attack on ECDH with     Weierstrass curves (bsc#965902).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

  - CVE-2015-7511: side-channel attack on ECDH with     Weierstrass curves (boo#965902)

New libgcrypt packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

GnuPG reports :

Mitigate side-channel attack on ECDH with Weierstrass curves.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt11 library could be leaked via a side-channel attack.

See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack.

See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

ID	Name	Product	Family	Severity
93946	GLSA-201610-04 : libgcrypt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
92769	Fedora 23 : libgcrypt (2016-ec4c27d766)	Nessus	Fedora Local Security Checks	low
92535	Fedora 24 : libgcrypt (2016-83cd045bcc)	Nessus	Fedora Local Security Checks	low
90911	openSUSE Security Update : libgcrypt (openSUSE-2016-559)	Nessus	SuSE Local Security Checks	low
90587	SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2016:1089-1)	Nessus	SuSE Local Security Checks	low
88979	openSUSE Security Update : libgcrypt (openSUSE-2016-267)	Nessus	SuSE Local Security Checks	low
88911	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : libgcrypt (SSA:2016-054-03)	Nessus	Slackware Local Security Checks	low
88747	Ubuntu 14.04 LTS : Libgcrypt vulnerability (USN-2896-1)	Nessus	Ubuntu Local Security Checks	low
88744	FreeBSD : libgcrypt -- side-channel attack on ECDH (95b92e3b-d451-11e5-9794-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	low
88741	Debian DSA-3478-1 : libgcrypt11 - security update	Nessus	Debian Local Security Checks	low
88725	Debian DSA-3474-1 : libgcrypt20 - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2015-7511

low

Tenable Plugins

medium

low

low

low

low

low

low

low

low

low

low