p PatchFirst

CVE-2017-2624

CVE-2017-2624

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.

CVSS 5.9 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • xorg-x11-server

    Versions
    • 1.19.0: Affected

    No fix published

  • xorg-server Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:1.19.2-1

    Update to 2:1.19.2-1

  • xorg-server Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:1.19.2-1

    Update to 2:1.19.2-1

  • xorg-server Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:1.19.2-1

    Update to 2:1.19.2-1

  • xorg-server Ubuntu:14.04:LTS

    Versions
    • 2:1.14.3-3ubuntu2
    • 2:1.14.3-3ubuntu3
    • 2:1.14.3-3ubuntu4
    • 2:1.14.3-5ubuntu1
    • 2:1.14.4-1ubuntu1
    • 2:1.14.4-1ubuntu2
    • 2:1.14.4.901-0ubuntu2
    • 2:1.14.5-1ubuntu2
    • 2:1.14.5-1ubuntu4
    • 2:1.15.0-1ubuntu1
    • 2:1.15.0-1ubuntu2
    • 2:1.15.0-1ubuntu3
    • 2:1.15.0-1ubuntu4
    • 2:1.15.0-1ubuntu6
    • 2:1.15.0-1ubuntu7
    • 2:1.15.1-0ubuntu1
    • 2:1.15.1-0ubuntu2
    • 2:1.15.1-0ubuntu2.1
    • 2:1.15.1-0ubuntu2.4
    • 2:1.15.1-0ubuntu2.5
    • 2:1.15.1-0ubuntu2.6
    • 2:1.15.1-0ubuntu2.7
    Affected ranges
    • ECOSYSTEM: < 2:1.15.1-0ubuntu2.9

    Update to 2:1.15.1-0ubuntu2.9

  • xorg-server-lts-xenial Ubuntu:14.04:LTS

    Versions
    • 2:1.18.3-1ubuntu2.2~trusty1
    • 2:1.18.3-1ubuntu2.2~trusty2
    • 2:1.18.3-1ubuntu2.2~trusty3
    • 2:1.18.3-1ubuntu2.3~trusty1
    Affected ranges
    • ECOSYSTEM: < 2:1.18.3-1ubuntu2.3~trusty2

    Update to 2:1.18.3-1ubuntu2.3~trusty2

  • xorg-server Ubuntu:16.04:LTS

    Versions
    • 2:1.17.2-1ubuntu9
    • 2:1.17.2-1ubuntu10
    • 2:1.17.3-2ubuntu1
    • 2:1.17.3-2ubuntu2
    • 2:1.17.3-2ubuntu3
    • 2:1.17.3-2ubuntu4
    • 2:1.18.1-1ubuntu3
    • 2:1.18.1-1ubuntu4
    • 2:1.18.3-1ubuntu1
    • 2:1.18.3-1ubuntu2
    • 2:1.18.3-1ubuntu2.2
    • 2:1.18.3-1ubuntu2.3
    • 2:1.18.4-0ubuntu0.1
    • 2:1.18.4-0ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 2:1.18.4-0ubuntu0.3

    Update to 2:1.18.4-0ubuntu0.3

  • xorg-server-hwe-16.04 Ubuntu:16.04:LTS

    Versions
    • 2:1.18.4-1ubuntu6.1~16.04.1
    Affected ranges
    • ECOSYSTEM: < 2:1.18.4-1ubuntu6.1~16.04.2

    Update to 2:1.18.4-1ubuntu6.1~16.04.2

Original sources

Check your server →