PT-2017-15454 · Xorg+3 · Xorg-X11-Server+3

Published 2017-03-01 · Updated 2024-06-15 · CVE-2017-2624

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xorg-x11-server versions prior to 1.19.0

Description A security issue was discovered where the use of memcmp() to verify the MIT cookie allows for a time difference between valid and invalid bytes, potentially enabling an efficient brute force attack.

Recommendations For versions prior to 1.19.0, update to version 1.19.0 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-385

Related Identifiers

ALT-PU-2017-2438

CVE-2017-2624

DLA-1186-1

MGASA-2017-0269

MGASA-2018-0200

OPENSUSE-SU-2024:11525-1

SUSE-SU-2017:1675-1

SUSE-SU-2017_1675-1

USN-3362-1

Affected Products

Alt Linux

Suse

Ubuntu

Xorg-X11-Server

References · 89

• 🔥 https://x41-dsec.de/lab/advisories/x41-2017-001-xorg · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12178 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12180 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-2438 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2624 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2624 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12183 · Security Note
• https://security.gentoo.org/glsa/201704-03 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11525-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1675-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2624 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10971 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10972 · Security Note