CVE-2001-1086: High severity Xfree86 Project X11r6 vulnerability

Published Jul 4, 2001

Updated

XDM in XFree86 3.3 and 3.3.3 generates easily guessable cookies using gettimeofday() when compiled with the HasXdmXauth option, which allows remote attackers to gain unauthorized access to the X display via a brute force attack.

Affected Software

2 affected components

Xfree86 Project X11r6=3.3

Xfree86 Project X11r6=3.3.3

Remediation

Patch Available

http://www.securityfocus.com/bid/2985

Event History

Jul 4, 2001

CVE Published

04:00 AM

Mar 15, 2002

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1086?

CVE-2001-1086 is considered to have a moderate severity due to its potential for unauthorized access to the X display.

How do I fix CVE-2001-1086?

To fix CVE-2001-1086, upgrade to a version of XFree86 that does not generate easily guessable cookies.

What software is affected by CVE-2001-1086?

CVE-2001-1086 affects XFree86 X Server versions 3.3 and 3.3.3 when compiled with the HasXdmXauth option.

How does CVE-2001-1086 allow for unauthorized access?

CVE-2001-1086 allows unauthorized access via easily guessable cookies that can be brute-forced by attackers.

Is there a patch available for CVE-2001-1086?

There is no specific patch for CVE-2001-1086; the recommended action is to upgrade to a secure version of XFree86.