Security readout for executives and security teams
Plain-English summary
This flaw affects Xorg libXdmcp session-key generation. On multi-user systems using XDMCP, a local user could potentially guess weak session keys using process-list information and hijack another user's graphical session. The issue is local, not remote, but confidentiality impact can be serious where XDMCP remains enabled.
Executive priority
Handle through normal vulnerability management, with faster action for shared Unix/Linux environments using XDMCP. This is not presented as internet-scale or actively exploited, but session hijacking risk makes unpatched multi-user systems business-relevant.
Technical view
libXdmcp used insufficient entropy for session keys, mapped to CWE-331. The CVSS 3.0 vector is local, low complexity, low privileges, no user interaction, changed scope, and high confidentiality impact. Sources describe exposure specifically on multi-user systems using XDMCP.
Likely exposure
Exposure is most likely on Linux or Unix systems with Xorg libXdmcp installed and XDMCP actively used, especially shared multi-user hosts. Modern systems not using XDMCP have lower practical exposure, but package presence should still be checked.
Exploitation context
The bundle does not identify known active exploitation, and KEV status is false. Exploitation requires local access and information available from the process list, then brute forcing weak session keys. No weaponized public exploit status is established in the provided sources.
Researcher notes
Do not generalize this to all Xorg deployments. The source-supported attack condition is local access on multi-user systems using XDMCP, with weak entropy enabling session-key brute force. Version and fix details should be confirmed against the relevant distribution advisory.
Mitigation direction
- Apply the relevant vendor libXdmcp security update for each distribution.
- Review Gentoo, Red Hat, Debian, and upstream Xorg guidance for fixed package details.
- Disable XDMCP where it is not operationally required.
- Prioritize shared multi-user systems before single-user workstations.
- Treat legacy remote graphical login services as higher-risk until verified.
Validation and detection
- Inventory systems with Xorg libXdmcp installed.
- Confirm whether XDMCP is enabled or used for graphical logins.
- Check installed package versions against vendor advisories.
- Prioritize hosts with multiple local users or shared shell access.
- Record whether vendor updates have been applied successfully.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-331: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-2625 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N24Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.5MediumVector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- GLSA-201704-03CVE reference · vendor-advisory, x_refsource_GENTOO
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2625CVE reference · x_refsource_CONFIRM
- RHSA-2017:1865CVE reference · vendor-advisory, x_refsource_REDHAT
- https://cgit.freedesktop.org/xorg/lib/libXdmcp/commit/?id=0554324ec6bbc2071f5d1f8ad211a1643e29eb1fCVE reference · x_refsource_CONFIRM
- https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/CVE reference · x_refsource_MISC
- [debian-lts-announce] 20191125 [SECURITY] [DLA 2006-1] libxdmcp security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Entropy
Insufficient Entropy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.