Test ID:	1.3.6.1.4.1.25623.1.0.891015
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-1015-1)
Summary:	The remote host is missing an update for the Debian 'libgcrypt11' package(s) announced via the DLA-1015-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'libgcrypt11' package(s) announced via the DLA-1015-1 advisory. Vulnerability Insight: It was discovered that there was a key disclosure vulnerability in libgcrypt11 a library of cryptographic routines: It is well known that constant-time implementations of modular exponentiation cannot use sliding windows. However, software libraries such as Libgcrypt, used by GnuPG, continue to use sliding windows. It is widely believed that, even if the complete pattern of squarings and multiplications is observed through a side-channel attack, the number of exponent bits leaked is not sufficient to carry out a full key-recovery attack against RSA. Specifically, 4-bit sliding windows leak only 40% of the bits, and 5-bit sliding windows leak only 33% of the bits. -- Sliding right into disaster: Left-to-right sliding windows leak For Debian 7 Wheezy, this issue has been fixed in libgcrypt11 version 1.5.0-5+deb7u6. We recommend that you upgrade your libgcrypt11 packages. Affected Software/OS: 'libgcrypt11' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-7526 BugTraq ID: 99338 http://www.securityfocus.com/bid/99338 Debian Security Information: DSA-3901 (Google Search) https://www.debian.org/security/2017/dsa-3901 Debian Security Information: DSA-3960 (Google Search) https://www.debian.org/security/2017/dsa-3960 https://eprint.iacr.org/2017/627 https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html http://www.securitytracker.com/id/1038915 https://usn.ubuntu.com/3733-1/ https://usn.ubuntu.com/3733-2/
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.