Ubuntu update for libice

1) Insufficient Entropy

EUVDB-ID: #VU32017

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-2626

CWE-ID: CWE-331 - Insufficient Entropy

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.

Mitigation

Update the affected package libice to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 18.04

libice-dev (Ubuntu package): before 2:1.0.9-2ubuntu0.18.04.1

libice6 (Ubuntu package): before 2:1.0.9-2ubuntu0.18.04.1

CPE2.3

• cpe:2.3:o:canonical:ubuntu:16.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:18.04:*:*:*:*:*:*:*
• cpe:2.3:a:canonical:libice-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libice6_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-5744-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.