Design/Logic Flaw

2018-07-2718:29:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users’ sessions.

CPENameOperatorVersion
enterprise_linuxeq7.0
enterprise_linux_desktopeq7.0
enterprise_linux_servereq7.0
enterprise_linux_server_auseq7.4
enterprise_linux_server_euseq7.4
enterprise_linux_server_euseq7.5
enterprise_linux_workstationeq7.0
libxdmcplt1.1.2

Name	Operator	Version
enterprise_linux	eq	7.0
enterprise_linux_desktop	eq	7.0
enterprise_linux_server	eq	7.0
enterprise_linux_server_aus	eq	7.4
enterprise_linux_server_eus	eq	7.4
enterprise_linux_server_eus	eq	7.5
enterprise_linux_workstation	eq	7.0
libxdmcp	lt	1.1.2