Information disclosure in libgcrypt (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2015-7511
CWE-ID CWE-200
Exploitation vector Local
Public exploit N/A
Vulnerable software
 libgcrypt (Alpine package)
Operating systems & Components / Operating system package or component

IBM Tivoli Storage Manager
Server applications / File servers (FTP/HTTP)

Vendor Alpine Linux Development Team
IBM Corporation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU32337

Risk: Low

CVSSv4.0: 0.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-7511

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libgcrypt (Alpine package): 1.6.1-r1 - 1.6.3-r0

IBM Tivoli Storage Manager: before 5.4.3.0

libgcrypt (Alpine package): before 0.2.8-0ubuntu1

libgcrypt (Alpine package): before 3.0pl1-124ubuntu2

libgcrypt (Alpine package): before 0.4.1-4

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=50c5627c9d06dca29a6659ea453cf13744758634
https://git.alpinelinux.org/aports/commit/?id=ac62e682204cffba83c50bb239066f30fad7d00c
https://git.alpinelinux.org/aports/commit/?id=7bba78bee999efc963c5103be483b0c21a0d84fb


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###