CVE-2017-2624: Infoleak
First published: Fri Jul 27 2018(Updated: )
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| X.org Xorg-server | <=1.19.4 | |
| Debian Debian Linux | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/96480
- http://www.securitytracker.com/id/1037919
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624
- https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c
- https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html
- https://security.gentoo.org/glsa/201704-03
- https://security.gentoo.org/glsa/201710-30
- https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/
Frequently Asked Questions
What is CVE-2017-2624?
CVE-2017-2624 is a vulnerability found in xorg-x11-server before version 1.19.0 that allows an attacker to attach to an Xorg session by exploiting a weakness in the comparison of MIT cookies.
How severe is CVE-2017-2624?
CVE-2017-2624 has a severity rating of 7, which is considered high.
What software is affected by CVE-2017-2624?
X.org Xorg-server versions up to and including 1.19.4 and Debian Debian Linux version 7.0 are affected by CVE-2017-2624.
How can I fix CVE-2017-2624?
To fix CVE-2017-2624, you should update to a version of xorg-x11-server that is equal to or greater than 1.19.0.
Are there any references for CVE-2017-2624?
Yes, you can find more information about CVE-2017-2624 at the following sources: [SecurityFocus](http://www.securityfocus.com/bid/96480), [SecurityTracker](http://www.securitytracker.com/id/1037919), and [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624).
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- vendor/x.org
- canonical/x.org xorg-server
- version/x.org xorg-server/1.19.4
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0