CVE-2017-2624
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.7%
probabilidade de exploração
0.7%top 50% das CVEs
exploração observada
nãonenhuma fonte reporta
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
Xorg · xorg-x11-serverReferências
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627chttps://lists.debian.org/debian-lts-announce/2017/11/msg00032.htmlhttps://security.gentoo.org/glsa/201704-03https://security.gentoo.org/glsa/201710-30https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/http://www.securityfocus.com/bid/96480http://www.securitytracker.com/id/1037919