CVE-2017-2625 – libXdmcp: weak entropy usage for session keys

https://notcve.org/view.php?id=CVE-2017-2625

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions. Se ha descubierto que libXdmcp en versiones anteriores a la 1.1.2 usaba entropía débil para generar claves de sesión. En un sistema multiusuario que utilice xdmcp, un atacante local podría utilizar la información disponible en la lista de procesos para usar un ataque de fuerza bruta en la clave, permitiéndole secuestrar las sesiones de otros usuarios. It was discovered that libXdmcp used weak entropy to generate session keys. • http://www.securityfocus.com/bid/96480 http://www.securitytracker.com/id/1037919 https://access.redhat.com/errata/RHSA-2017:1865 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2625 https://cgit.freedesktop.org/xorg/lib/libXdmcp/commit/?id=0554324ec6bbc2071f5d1f8ad211a1643e29eb1f https://lists.debian.org/debian-lts-announce/2019/11/msg00024.html https://security.gentoo.org/glsa/201704-03 https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg https://access.redhat.com/security& • CWE-320: Key Management Errors CWE-331: Insufficient Entropy •