CWE-334: Small Space of Random Values Small Space of Random Values
Weakness ID: 334 (Weakness Base) Status: Draft
Description
Description Summary
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope Effect Other
Access Control
Technical Impact: Other; Bypass protection
mechanism
Observed Examples
Reference Description CVE-2002-0583 Product uses 5 alphanumeric characters for
filenames of expense claim reports, stored under web
root. CVE-2002-0903 Product uses small number of random numbers for a
code to approve an action, and also uses predictable new user IDs, allowing
attackers to hijack new accounts. CVE-2003-1230 SYN cookies implementation only uses 32-bit keys,
making it easier to brute force ISN. CVE-2004-0230 Complex predictability / randomness (reduced
space).
Potential Mitigations
Phases: Architecture and Design; Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [R.334.1 ] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Phase: Implementation
Consider a PRNG which re-seeds itself, as needed from a high quality
pseudo-random output, like hardware devices.
Relationships
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Small Space of Random Values
References
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships,
Taxonomy_Mappings 2009-03-10 CWE Content Team MITRE Internal updated Potential_Mitigations 2009-12-28 CWE Content Team MITRE Internal updated Potential_Mitigations 2010-06-21 CWE Content Team MITRE Internal updated Potential_Mitigations 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences 2011-09-13 CWE Content Team MITRE Internal updated Potential_Mitigations,
References
Description
