CVE-2017-2626 – libICE: weak entropy usage in session keys

https://notcve.org/view.php?id=CVE-2017-2626

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list. Se ha descubierto que libICE en versiones anteriores a la 1.0.9-8 usaba una entropía débil para generar claves. Un atacante local podría utilizar este fallo para secuestrar sesiones utilizando la información disponible en la lista de procesos. It was discovered that libICE used a weak entropy to generate keys. • http://www.openwall.com/lists/oss-security/2019/07/14/3 http://www.securityfocus.com/bid/96480 http://www.securitytracker.com/id/1037919 https://access.redhat.com/errata/RHSA-2017:1865 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2626 https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b https://lists.debian.org/debian-lts-announce/2019/11/msg00022.html https://security.gentoo.org/glsa/201704-03 https://www.x41-dsec.de/lab • CWE-331: Insufficient Entropy •