CVE-2017-2625: Medium severity libxdmcp6 vulnerability
It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.
Other sources
The following flaw was reported in libXdmcp:
Summary and Impact ------------------
XDM uses weak entropy to generate the session keys on non-BSD systems:
void XdmcpGenerateKey (XdmAuthKeyPtr key) { #ifndef HAVEARC4RANDOMBUF long lowbits, highbits; srandom ((int)getpid() ^ time((Timet )0)); lowbits = random (); highbits = random (); getbits (lowbits, key->data); getbits (highbits, key->data + 4); #else arc4randombuf(key->data, 8); #endif }
On multi user systems it might possible to check the PID of the process and how long it is running to get an estimate of these values, which could allow an attacker to attach to the session of a different user.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2625?
CVE-2017-2625 has been assigned a high severity rating due to the potential for local attackers to hijack user sessions.
How do I fix CVE-2017-2625?
To mitigate CVE-2017-2625, update libXdmcp to version 1.1.2 or later.
Which systems are affected by CVE-2017-2625?
CVE-2017-2625 affects versions of libXdmcp prior to 1.1.2 on multi-user systems utilizing XDMCP.
Can CVE-2017-2625 be exploited remotely?
CVE-2017-2625 is not remotely exploitable; it requires local access to the system.
What are the consequences of an exploited CVE-2017-2625 vulnerability?
Exploiting CVE-2017-2625 allows attackers to potentially hijack other users' sessions and access sensitive information.