CVE

Id
64523  
CVE No.
CVE-2013-4576  
Status
Candidate  
Description
GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
635918 64523 CVE-2013-4576 MLIST:[gnupg-devel] 20131218 [Announce] [security fix] GnuPG 1.4.16 released  View
635919 64523 CVE-2013-4576 URL:http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html  View
635920 64523 CVE-2013-4576 MLIST:[oss-security] 20131218 GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)  View
635921 64523 CVE-2013-4576 URL:http://seclists.org/oss-sec/2013/q4/520  View
635922 64523 CVE-2013-4576 MLIST:[oss-security] 20131218 Re: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)  View
635923 64523 CVE-2013-4576 URL:http://seclists.org/oss-sec/2013/q4/523  View
635924 64523 CVE-2013-4576 MISC:http://www.cs.tau.ac.il/~tromer/acoustic/  View
635925 64523 CVE-2013-4576 MISC:http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf  View
635926 64523 CVE-2013-4576 DEBIAN:DSA-2821  View
635927 64523 CVE-2013-4576 URL:http://www.debian.org/security/2013/dsa-2821  View
635928 64523 CVE-2013-4576 REDHAT:RHSA-2014:0016  View
635929 64523 CVE-2013-4576 URL:http://rhn.redhat.com/errata/RHSA-2014-0016.html  View
635930 64523 CVE-2013-4576 UBUNTU:USN-2059-1  View
635931 64523 CVE-2013-4576 URL:http://www.ubuntu.com/usn/USN-2059-1  View
635932 64523 CVE-2013-4576 BID:64424  View
635933 64523 CVE-2013-4576 URL:http://www.securityfocus.com/bid/64424  View
635934 64523 CVE-2013-4576 OSVDB:101170  View
635935 64523 CVE-2013-4576 URL:http://osvdb.org/101170  View
635936 64523 CVE-2013-4576 SECTRACK:1029513  View
635937 64523 CVE-2013-4576 URL:http://www.securitytracker.com/id/1029513  View
635938 64523 CVE-2013-4576 XF:gunpg-cve20134576-info-disclosure(89846)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24850 JVNDB-2013-006425 GitLab および gitlab-shell における任意のコードを実行される脆弱性 GitLab および gitlab-shell には、任意のコードを実行される脆弱性が存在します。 CVE-2013-4581 64523 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006425.html  View