Read Time:50 Second

Description

The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-330
CWE-330

 

Consequences

Access Control, Other: Bypass Protection Mechanism, Other

An attacker could guess the random numbers generated and could gain unauthorized access to a system if the random numbers are used for authentication and authorization.

 

Potential Mitigations

Phase: Implementation

Description: 

Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

CVE References

  • CVE-2001-0950
    • Insufficiently random data used to generate session tokens using C rand(). Also, for certificate/key generation, uses a source that does not block when entropy is low.
  • CVE-2008-2108
    • Chain: insufficient precision (CWE-1339) in
      random-number generator causes some zero bits to be reliably
      generated, reducing the amount of entropy (CWE-331)