CVE ID:	CVE-2017-2624
Description:	It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.
Test IDs:	1.3.6.1.4.1.25623.1.1.4.2017.1741.1   1.3.6.1.4.1.25623.1.0.874221   1.3.6.1.4.1.25623.1.0.874231   1.3.6.1.4.1.25623.1.0.874184   1.3.6.1.4.1.25623.1.0.874220   1.3.6.1.4.1.25623.1.1.4.2017.1675.1   1.3.6.1.4.1.25623.1.1.10.2018.0200
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2017-2624 1037919 http://www.securitytracker.com/id/1037919 96480 http://www.securityfocus.com/bid/96480 GLSA-201704-03 https://security.gentoo.org/glsa/201704-03 GLSA-201710-30 https://security.gentoo.org/glsa/201710-30 [debian-lts-announce] 20171122 [SECURITY] [DLA 1186-1] xorg-server security update https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624 https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/