Libgcrypt weak encryption in Oracle products - CVE-2016-6313

Vulnerability identifier: #VU327

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6313

CWE-ID: CWE-330

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to decrypt data.

The vulnerability exists in the Libgcrypt library due to weak implementation of random number generator. A local user, who can obtain 4640 bits from random generator, can predict the next 160 bits of output.

Successful exploitation of this vulnerability may result in generation of weak encryption keys and may lead to sensitive information disclosure.

 

Libgcrypt
Oracle VM Server for x86
Oracle Linux
Debian Linux
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Ubuntu
Slackware Linux
Fedora
libgcrypt (Alpine package)
gnupg
libgcrypt
IBM Tivoli Storage Manager
Integrated Management Module II (IMM2)

Install the latest version of the library: 1.5.6, 1.6.6 or 1.7.3.

libgcrypt (Alpine package) - update to 1.6.6-r0
Integrated Management Module II (IMM2) - update to 1AOO76I-6.00
gnupg - addressed in versions 1.4.21-1.fc23, 1.4.21-1.fc24, 1.4.21-1.fc25
libgcrypt - addressed in versions 1.6.6-1.fc23, 1.6.6-1.fc25

• https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
• http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

• Predictable random number generator output in Libgcrypt
• Predictable Libgcrypt random number generator output in GnuPG
• Debian update for libgcrypt20
• Debian update for gnupg
• Ubuntu update for Libgcrypt
• Ubuntu update for GnuPG
• Arch Linux update for lib32-libgcrypt
• Arch Linux update for libgcrypt
• Slackware Linux update for libgcrypt
• Slackware Linux update for gnupg
• Amazon Linux AMI update for libgcrypt, gnupg
• Gentoo update for GnuPG
• Red Hat update for libgcrypt
• Libgcrypt weak encryption in libgcrypt (Alpine package)
• Libgcrypt weak encryption in IBM Integrated Management Module II (IMM2)
• Fedora 23 update for libgcrypt
• Fedora 25 update for libgcrypt
• Fedora 25 update for gnupg
• Fedora 24 update for gnupg
• Fedora 23 update for gnupg