Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Ubuntu 16.04 LTS USN-3064-1 Moderate: GnuPG Random Number Predictability

ubuntu
Calendar Grey August 18, 2016
Scroller Ubuntu
Recent GnuPG flaw exposes potential to forecast random number generation. Ensure your Ubuntu system is updated promptly to address these security threats.
GnuPG incorrectly generated random numbers.

Summary

GnuPG incorrectly generated random numbers.

Software Description:

- gnupg: GNU privacy guard - a free PGP replacement

Details:

Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled

mixing functions in the random number generator. An attacker able to obtain

4640 bits from the RNG can trivially predict the next 160 bits of output.

Topics%20covered

Topics Covered

security advisory security issue gnupg Ubuntu moderate severity update instructions random number

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  gnupg                           1.4.20-1ubuntu3.1

Ubuntu 14.04 LTS:
  gnupg                           1.4.16-1ubuntu2.4

Ubuntu 12.04 LTS:
  gnupg                           1.4.11-3ubuntu2.10

In general, a standard system update will make all the necessary changes.

References

CVE-2016-6313

Severity
important
Lowest
Low
Medium
High
Critical

August 18, 2016

Topics%20covered

Topics Covered

security advisory security issue gnupg Ubuntu moderate severity update instructions random number

Package Information

https://launchpad.net/ubuntu/+source/gnupg/1.4.20-1ubuntu3.1
https://launchpad.net/ubuntu/+source/gnupg/1.4.16-1ubuntu2.4
https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.10

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.