Use of Insufficiently Random Values

Opis

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Skutki

• Confidentiality, Other

  Other

  When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.

• Access Control, Other

  Bypass Protection Mechanism; Other

  If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the resource to the intended user. For example, a product might maintain session information in a file whose name is based on a username. An attacker could pre-create this file for a victim user, then set the permissions so that the application cannot generate the session for the victim, preventing the victim from using the application.

• Access Control

  Bypass Protection Mechanism; Gain Privileges or Assume Identity

  When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.

Zapobieganie

• Architecture and Design

  Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds.

  In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.

  Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.

• Implementation

  Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.

• Architecture and Design, Requirements · Libraries or Frameworks

  Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

Przykłady podatności

• CVE-2021-3692 PHP framework uses mt_rand() function (Marsenne Twister) when generating tokens
• CVE-2020-7010 Cloud application on Kubernetes generates passwords using a weak random number generator based on deployment time.
• CVE-2009-3278 Crypto product uses rand() library function to generate a recovery key, making it easier to conduct brute force attacks.
• CVE-2009-3238 Random number generator can repeatedly generate the same value.
• CVE-2009-2367 Web application generates predictable session IDs, allowing session hijacking.
• CVE-2009-2158 Password recovery utility generates a relatively small number of random passwords, simplifying brute force attacks.
• CVE-2009-0255 Cryptographic key created with a seed based on the system time.
• CVE-2008-5162 Kernel function does not have a good entropy source just after boot.
• CVE-2008-4905 Blogging software uses a hard-coded salt when calculating a password hash.
• CVE-2008-4929 Bulletin board application uses insufficiently random names for uploaded files, allowing other users to access private files.
• CVE-2008-3612 Handheld device uses predictable TCP sequence numbers, allowing spoofing or hijacking of TCP connections.
• CVE-2008-2433 Web management console generates session IDs based on the login time, making it easier to conduct session hijacking.
• CVE-2008-0166 SSL library uses a weak random number generator that only generates 65,536 unique keys.
• CVE-2008-2108 Chain: insufficient precision causes extra zero bits to be assigned, reducing entropy for an API function that generates random numbers.
• CVE-2008-2108 Chain: insufficient precision (CWE-1339) in random-number generator causes some zero bits to be reliably generated, reducing the amount of entropy (CWE-331)
• CVE-2008-2020 CAPTCHA implementation does not produce enough different images, allowing bypass using a database of all possible checksums.
• CVE-2008-0087 DNS client uses predictable DNS transaction IDs, allowing DNS spoofing.
• CVE-2008-0141 Application generates passwords that are based on the time of day.

Słabość nadrzędna

• CWE-693 Protection Mechanism Failure

Może prowadzić do

• CWE-804 Guessable CAPTCHA

Słabości podrzędne

• CWE-331 Insufficient Entropy
• CWE-334 Small Space of Random Values
• CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
• CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CWE-340 Generation of Predictable Numbers or Identifiers
• CWE-344 Use of Invariant Value in Dynamically Changing Context
• CWE-1204 Generation of Weak Initialization Vector (IV)
• CWE-1241 Use of Predictable Algorithm in Random Number Generator

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

This can be primary to many other weaknesses such as cryptographic errors, authentication errors, symlink following, information leaks, and others.

As of CWE 4.3, CWE-330 and its descendants are being investigated by the CWE crypto team to identify gaps related to randomness and unpredictability, as well as the relationships between randomness and cryptographic primitives. This "subtree analysis" might result in the addition or deprecation of existing entries; the reorganization of relationships in some views, e.g. the research view (CWE-1000); more consistent use of terminology; and/or significant modifications to related entries.

As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely. Within the developer and other communities, "randomness" is used heavily. However, within cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonly-used definitions, even within standards documents and cryptography papers. Future versions of CWE will attempt to define these terms and, if necessary, distinguish between them in ways that are appropriate for different communities but do not reduce the usability of CWE for mapping, understanding, or other scenarios.

Źródła

1. FIPS PUB 140-2: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES — Information Technology Laboratory, National Institute of Standards and Technology, 2001
2. Building Secure Software: How to Avoid Security Problems the Right Way — John Viega, Gary McGraw, Addison-Wesley, 2002
3. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 8, "Using Poor Random Numbers" Page 259, Microsoft Press, 2002
4. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 20: Weak Random Numbers." Page 299, McGraw-Hill, 2010
5. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014