CVE-2017-2625

Published: 27/07/2018 Updated: 12/02/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

It exists that libXdmcp prior to 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
x.org libxdmcp
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5

Debian Bug report logs - #856399 libxdmcp: CVE-2017-2625: Weak entropy usage for session keys in libxdm Package: src:libxdmcp; Maintainer for src:libxdmcp is Debian X Strike Force <debian-x@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 28 Feb 2017 15:54:02 UTC Severity: important ...

It was discovered that libXdmcp used weak entropy to generate session keys On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions ...

Xorg suffers from privilege escalation, weak entropy, and use-after-free vulnerabilities ...

This issue was already disclosed at: wwwx41-dsecde/lab/advisories/x41-2017-001-xorg/ wwwopenwallcom/lists/oss-security/2017/02/28/3 This just upgrades the fix from a git commit/patch to a released tarball -Alan Coopersmith- alancoopersmith () oracle com XOrg Security Response Team - xorg-s ...

Hack the box course

Linux Structure History Many events led up to creating the first Linux kernel and, ultimately, the Linux operating system (OS), starting with the Unix operating system's release by Ken Thompson and Dennis Ritchie (whom both worked for AT&T at the time) in 1970 The Berkeley Software Distribution (BSD) was released in 1977, but since it contained the Unix code owne

CWE-331 https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2625 https://security.gentoo.org/glsa/201704-03 https://access.redhat.com/errata/RHSA-2017:1865 http://www.securitytracker.com/id/1037919 http://www.securityfocus.com/bid/96480 https://cgit.freedesktop.org/xorg/lib/libXdmcp/commit/?id=0554324ec6bbc2071f5d1f8ad211a1643e29eb1f https://lists.debian.org/debian-lts-announce/2019/11/msg00024.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856399 https://nvd.nist.gov https://github.com/nediazla/LinuxFundamentals https://access.redhat.com/security/cve/cve-2017-2625

CVE-2017-2625

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect