Test ID:	1.3.6.1.4.1.25623.1.0.703649
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3649-1)
Summary:	The remote host is missing an update for the Debian 'gnupg' package(s) announced via the DSA-3649-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'gnupg' package(s) announced via the DSA-3649-1 advisory. Vulnerability Insight: Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug for GnuPG shows that existing RSA keys are not weakened. For DSA and Elgamal keys it is also unlikely that the private key can be predicted from other public information. For the stable distribution (jessie), this problem has been fixed in version 1.4.18-7+deb8u2. We recommend that you upgrade your gnupg packages. Affected Software/OS: 'gnupg' package(s) on Debian 8. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6313 BugTraq ID: 92527 http://www.securityfocus.com/bid/92527 Debian Security Information: DSA-3649 (Google Search) http://www.debian.org/security/2016/dsa-3649 Debian Security Information: DSA-3650 (Google Search) http://www.debian.org/security/2016/dsa-3650 https://security.gentoo.org/glsa/201610-04 https://security.gentoo.org/glsa/201612-01 https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html RedHat Security Advisories: RHSA-2016:2674 http://rhn.redhat.com/errata/RHSA-2016-2674.html http://www.securitytracker.com/id/1036635 http://www.ubuntu.com/usn/USN-3064-1 http://www.ubuntu.com/usn/USN-3065-1
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.