A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
MFV. predictable filename and insecure permissions
allows file modification to execute SQL
queries.
Potential Mitigations
Increase the entropy used to seed a PRNG.
Phases: Architecture and Design; Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [R.341.1] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Phase: Implementation
Consider a PRNG which re-seeds itself, as needed from a high quality
pseudo-random output, like hardware devices.
Description
