CVE-2001-1086

Description

XDM in XFree86 3.3 and 3.3.3 generates easily guessable cookies using gettimeofday() when compiled with the HasXdmXauth option, which allows remote attackers to gain unauthorized access to the X display via a brute force attack.

Affected products

• xfree86_project / x11r63.3 – 3.3
• xfree86_project / x11r63.3.3 – 3.3.3

Exploits & proofs of concept

• exploit-dbXFree86 X11R6 3.3 XDM - Session Cookie Guessingby ntf & sky

References

• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/6808
• MISChttp://online.securityfocus.com/archive/1/195008
• MISChttp://www.securityfocus.com/archive/1/194907
• MISChttp://www.securityfocus.com/bid/2985