CVE-2017-17878
critical
CVSS v3
9.8
CVSS v2
10.0
VIR risk
9.8
Description
An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES (aka the CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des" setting).
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://github.com/ValveSoftware/steamlink-sdk/issues/110
Vendor advisory: cve@mitre.org — https://github.com/ValveSoftware/steamlink-sdk/issues/101
Vendor advisory: cve@mitre.org — https://blogger.davidmanouchehri.com/2017/12/steam-link-security-truncated-password.html
References
- https://blogger.davidmanouchehri.com/2017/12/steam-link-security-truncated-password.html
- https://github.com/ValveSoftware/steamlink-sdk/issues/101
- https://github.com/ValveSoftware/steamlink-sdk/issues/110
- https://blogger.davidmanouchehri.com/2017/12/steam-link-security-truncated-password.html
- https://github.com/ValveSoftware/steamlink-sdk/issues/101
- https://github.com/ValveSoftware/steamlink-sdk/issues/110
CWEs
CWE-327
Verify integrity in audit chain (admin only). AS-IS.