名称: Small Space of Random Values
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
基本信息
引入方式
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
适用平台
编程语言
类： Not Language-Specific (Undetermined)技术
类： Not Technology-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Access Control Other | Bypass Protection Mechanism, Other 注意： An attacker could easily guess the values used. This could lead to unauthorized access to a system if the seed is used for authentication and authorization. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2002-0583 | Product uses 5 alphanumeric characters for filenames of expense claim reports, stored under web root. |
CVE-2002-0903 | Product uses a small number of random numbers for a code to approve an action, and also uses predictable new user IDs, allowing attackers to hijack new accounts. |
CVE-2003-1230 | SYN cookies implementation only uses 32-bit keys, making it easier to brute force ISN. |
CVE-2004-0230 | Complex predictability / randomness (reduced space). |
潜在缓解措施
Phases : Architecture and Design // RequirementsUse products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
漏洞映射说明
依据 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
备注
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely. Within the developer and other communities, "randomness" is used heavily. However, within cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonly-used definitions, even within standards documents and cryptography papers. Future versions of CWE will attempt to define these terms and, if necessary, distinguish between them in ways that are appropriate for different communities but do not reduce the usability of CWE for mapping, understanding, or other scenarios.参考资料
REF-267
FIPS PUB 140-2: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULESInformation Technology Laboratory, National Institute of Standards and Technology.
https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402.pdf
REF-44
24 Deadly Sins of Software SecurityMichael Howard, David LeBlanc, John Viega.
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Potential_Mitigations, References | |
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, References, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Modes_of_Introduction, References, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Maintenance_Notes | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples |
