Debian DSA-2730-1 : gnupg - information leak

Yarom and Falkner discovered that RSA secret keys could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system. This update fixes this issue for the 1.4 series of GnuPG. GnuPG 2.x is affected through its use of the...

[SECURITY] [DSA 2731-1] libgcrypt11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2731-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst July 29, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2731-1 (libgcrypt11 - information leak)

Yarom and Falkner discovered that RSA secret keys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system. OpenVAS Vulnerability Test $Id:...

FreeBSD : gnupg -- side channel attack on RSA secret keys (80771b89-f57b-11e2-bf21-b499baab0cbe)

A Yarom and Falkner paper reports : Flush+Reload is a cache side-channel attack that monitors access to data in shared pages. In this paper we demonstrate how to use the attack to extract private encryption keys from GnuPG. The high resolution and low noise of the Flush+Reload attack enables a sp...

CVE-2012-6581

Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail...

gnupg -- side channel attack on RSA secret keys

A Yarom and Falkner paper reports: Flush+Reload is a cache side-channel attack that monitors access to data in shared pages. In this paper we demonstrate how to use the attack to extract private encryption keys from GnuPG. The high resolution and low noise of the Flush+Reload attack enables a spy...

PT-2012-1195

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 0.23.4 Apache Hadoop 1.x versions prior to 1.0.4 Apache Hadoop 2.x versions prior to 2.0.2 Description The issue is related to errors in the implementation of cryptographic algorithms for generating temporary...

Cryptosystems Showing Signs of 'Wear and Tear'

SAN FRANCISCO– It’s been an interesting year in the cryptography world, with new attacks on several algorithms, continued problems with hash functions and the recent research on weak RSA keys. With all of that as a backdrop, some of the brightest minds in the field, gathered here for the RSA...

Данные из взломанного процессинга Хронопэй

Ровно неделя прошла с момента опубликования заявления группы хакеров о взломе платежной системы «Chronopay», краже массива кредитных карт http://chronoplay.livejournal.com/586.html и личных данных миллионов россиян. Поскольку официальные лица компании продолжают делать вид, что ничего не произошл...

Debian Security Advisory DSA 010-1 (gnupg)

The remote host is missing an update to gnupg announced via advisory DSA 010-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2001-1707 · Isc · Bind

Name of the Vulnerable Software and Affected Versions: BIND versions 8.2.4 and earlier BIND versions 9.1.2 and earlier Description: The issue allows attackers to obtain HMAC-MD5 shared secret keys used for DNS Transactional Signatures TSIG due to insecure permissions set by dnskeygen in BIND 8 an...