Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:1610-1

Опубликовано: 19 июн. 2017
Источник: suse-cvrf

Описание

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following security issues:

  • CVE-2017-2624: Prevent timing attack against MIT cookie. (boo#1025029)
  • Use arc4random to generate cookies with more randomness. (boo#1025084)
  • Remove unused function with use-after-free issue. (boo#1025035)

Список пакетов

openSUSE Leap 42.2
xorg-x11-server-7.6_1.18.3-12.15.2
xorg-x11-server-extra-7.6_1.18.3-12.15.2
xorg-x11-server-sdk-7.6_1.18.3-12.15.2
xorg-x11-server-source-7.6_1.18.3-12.15.2

Ссылки

Описание

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.

Затронутые продукты
openSUSE Leap 42.2:xorg-x11-server-7.6_1.18.3-12.15.2
openSUSE Leap 42.2:xorg-x11-server-extra-7.6_1.18.3-12.15.2
openSUSE Leap 42.2:xorg-x11-server-sdk-7.6_1.18.3-12.15.2
openSUSE Leap 42.2:xorg-x11-server-source-7.6_1.18.3-12.15.2
Ссылки