CVEs-PoC/2017/CVE-2017-2625.md

CVE-2017-2625

Description

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

POC

Reference

• https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/
• https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/

Github

• https://github.com/nediazla/LinuxFundamentals