[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 1 Mar 2017 11:01:30 +1030
From: Doran Moppert <dmoppert@...hat.com>
To: oss-security@...ts.openwall.com
Subject: three issues in xorg (CVE-2016-2624, CVE-2016-2625, CVE-2016-2626)
Vulnerabilities in xorg (server, libXdmcp, libICE) were recently
reported by Eric Sesterhenn of X41, and assigned CVEs by Red Hat.
> CVE-2017-2624 xorg-x11-server: timing attack against MIT Cookie
mitauth.c uses memcmp() to check the validity of MIT cookies, exposing a
possible timing attack on some platforms.
https://bugzilla.redhat.com/show_bug.cgi?id=1424984
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856398
https://bugzilla.novell.com/show_bug.cgi?id=1025029
> CVE-2017-2625 libXdmcp: weak entropy usage for session keys
In the absence of arc4random(), xdmcp session keys are generated based
on getpid() and time(), which may allow a local attacker to brute-force
the key.
https://bugzilla.redhat.com/show_bug.cgi?id=1424987
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856399
https://bugzilla.novell.com/show_bug.cgi?id=1025046
> CVE-2017-2626 libICE: weak entropy usage in session keys
In the absence of arc4random(), the Inter-Client Exchange session keys
are generated based on gettimeofday(), which may allow a local attacker
to brute-force the key.
https://bugzilla.redhat.com/show_bug.cgi?id=1424992
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856400
https://bugzilla.novell.com/show_bug.cgi?id=1025068
The first issue is mitigated with recent glibc's memcmp, particularly
with -D_FORTIFY_SOURCE=2, and the other two by providing an
implementation of arc4random at compile time, such as libbsd.
I expect these to be announced shortly at
<https://www.x.org/wiki/Development/Security/>.
--
Doran Moppert
Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
