Small Space of Random Values

Opis

The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

Skutki

• Access Control, Other

  Bypass Protection Mechanism; Other

  An attacker could easily guess the values used. This could lead to unauthorized access to a system if the seed is used for authentication and authorization.

Zapobieganie

• Architecture and Design, Requirements · Libraries or Frameworks

  Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

Przykłady podatności

• CVE-2002-0583 Product uses 5 alphanumeric characters for filenames of expense claim reports, stored under web root.
• CVE-2002-0903 Product uses small number of random numbers for a code to approve an action, and also uses predictable new user IDs, allowing attackers to hijack new accounts.
• CVE-2003-1230 SYN cookies implementation only uses 32-bit keys, making it easier to brute force ISN.
• CVE-2004-0230 Complex predictability / randomness (reduced space).

Słabość nadrzędna

• CWE-330 Use of Insufficiently Random Values

Słabości podrzędne

• CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely. Within the developer and other communities, "randomness" is used heavily. However, within cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonly-used definitions, even within standards documents and cryptography papers. Future versions of CWE will attempt to define these terms and, if necessary, distinguish between them in ways that are appropriate for different communities but do not reduce the usability of CWE for mapping, understanding, or other scenarios.

Źródła

1. FIPS PUB 140-2: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES — Information Technology Laboratory, National Institute of Standards and Technology, 2001
2. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 20: Weak Random Numbers." Page 299, McGraw-Hill, 2010