CVE-2017-2624 It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xor...
HighCVSS 7.0
EPSS 0.70%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xorg-server(Debian:12) | < 2:1.19.2-1 | 2:1.19.2-1 |
| debian/xorg-server(Debian:13) | < 2:1.19.2-1 | 2:1.19.2-1 |
| debian/xorg-server(Debian:14) | < 2:1.19.2-1 | 2:1.19.2-1 |
| x.org x server | <= 1.19.4 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| xorg-x11-server | = 1.19.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-2624 vendor-advisory
- 96480 third-party-advisory vdb-entry
- 1037919 third-party-advisory vdb-entry
- bugzilla.redhat.com exploit issue-tracking third-party-advisory
- gitlab.freedesktop.org patch third-party-advisory
- [debian-lts-announce] 20171122 [SECURITY] [DLA 1186-1] xorg-server security update mailing-list third-party-advisory
- GLSA-201704-03 third-party-advisory vendor-advisory
- GLSA-201710-30 third-party-advisory vendor-advisory
- www.x41-dsec.de exploit third-party-advisory
- bugs.debian.org issue-tracking