Ubuntu 14.10: USN-2555-1 Moderate: Libgcrypt Physical Key Attack

ubuntu

April 1, 2015

Several security issues were fixed in Libgcrypt.

Summary

Several security issues were fixed in Libgcrypt.

Software Description:

- libgcrypt11: LGPL Crypto library

- libgcrypt20: LGPL Crypto library

Details:

Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered

that Libgcrypt was susceptible to an attack via physical side channels. A

local attacker could use this attack to possibly recover private keys.

(CVE-2014-3591)

Daniel Genkin, Adi Shamir, and Eran Tromer discovered that Libgcrypt was

susceptible to an attack via physical side channels. A local attacker could

use this attack to possibly recover private keys. (CVE-2015-0837)

Topics Covered

security advisory moderate security issue Ubuntu key recovery physical attack libgcrypt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libgcrypt11                     1.5.4-2ubuntu1.1
  libgcrypt20                     1.6.1-2ubuntu1.14.10.1

Ubuntu 14.04 LTS:
  libgcrypt11                     1.5.3-2ubuntu4.2

Ubuntu 12.04 LTS:
  libgcrypt11                     1.5.0-3ubuntu0.4

Ubuntu 10.04 LTS:
  libgcrypt11                     1.4.4-5ubuntu2.4

In general, a standard system update will make all the necessary changes.