Published: 27/07/2018 Updated: 12/02/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

It exists that libXdmcp prior to 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
x.org libxdmcp
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5

Debian Bug report logs - #856399 libxdmcp: CVE-2017-2625: Weak entropy usage for session keys in libxdm Package: src:libxdmcp; Maintainer for src:libxdmcp is Debian X Strike Force <debian-x@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 28 Feb 2017 15:54:02 UTC Severity: important ...

It was discovered that libXdmcp used weak entropy to generate session keys On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions ...

Xorg suffers from privilege escalation, weak entropy, and use-after-free vulnerabilities ...

CWE-331 https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2625 https://security.gentoo.org/glsa/201704-03 https://access.redhat.com/errata/RHSA-2017:1865 http://www.securitytracker.com/id/1037919 http://www.securityfocus.com/bid/96480 https://cgit.freedesktop.org/xorg/lib/libXdmcp/commit/?id=0554324ec6bbc2071f5d1f8ad211a1643e29eb1f https://lists.debian.org/debian-lts-announce/2019/11/msg00024.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856399 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2017-2625

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2017-2625

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect