The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Other
Technical Impact: Bypass protection
mechanism; Other
An attacker could easily guess the values used. This could lead to
unauthorized access to a system if the seed is used for authentication
and authorization.
Demonstrative Examples
Example 1
The following XML example code is a deployment descriptor for a Java
web application deployed on a Sun Java Application Server. This deployment
descriptor includes a session configuration property for configuring the
session ID length.
(Bad Code)
Example
Language: XML
<sun-web-app>
...
<session-config>
<session-properties>
<property name="idLengthBytes"
value="8">
<description>The number of bytes in
this web module's session
ID.</description>
</property>
</session-properties>
</session-config>
...
</sun-web-app>
This deployment descriptor has set the session ID length for this Java
web application to 8 bytes (or 64 bits). The session ID length for Java
web applications should be set to 16 bytes (128 bits) to prevent
attackers from guessing and/or stealing a session ID and taking over a
user's session.
Note for most application servers including the Sun Java Application
Server the session ID length is by default set to 128 bits and should
not be changed. And for many application servers the session ID length
cannot be changed from this default setting. Check your application
server documentation for the session ID length default setting and
configuration options to ensure that the session ID length is set to 128
bits.
Product uses small number of random numbers for a
code to approve an action, and also uses predictable new user IDs, allowing
attackers to hijack new accounts.
Use products or modules that conform to FIPS 140-2 [R.334.1] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
[R.334.2] [REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 20: Weak Random Numbers." Page 299. McGraw-Hill. 2010.
Description
