Description
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-330
Consequences
Access Control, Other: Bypass Protection Mechanism, Other
An attacker could easily guess the values used. This could lead to unauthorized access to a system if the seed is used for authentication and authorization.
Potential Mitigations
Phase: Architecture and Design, Requirements
Description:
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (“Approved Random Number Generators”).
CVE References
- CVE-2002-0583
- Product uses 5 alphanumeric characters for filenames of expense claim reports, stored under web root.
- CVE-2002-0903
- Product uses small number of random numbers for a code to approve an action, and also uses predictable new user IDs, allowing attackers to hijack new accounts.
- CVE-2003-1230
- SYN cookies implementation only uses 32-bit keys, making it easier to brute force ISN.
- CVE-2004-0230
- Complex predictability / randomness (reduced space).
