FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-4576

This CVE name corresponds to:

Entered	Topic
2013-12-18	gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-4576 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-4576
Phase	Assigned(20130612)

Description

GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.

References

Source	Reference
MLIST	[gnupg-devel] 20131218 [Announce] [security fix] GnuPG 1.4.16 released
MLIST	[oss-security] 20131218 GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)
MLIST	[oss-security] 20131218 Re: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)
MISC	http://www.cs.tau.ac.il/~tromer/acoustic/
MISC	http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf
DEBIAN	DSA-2821
REDHAT	RHSA-2014:0016
UBUNTU	USN-2059-1
BID	64424
OSVDB	101170
SECTRACK	1029513
XF	gunpg-cve20134576-info-disclosure(89846)