Component for web browser writes an error message
to a known location, which can then be referenced by attackers to process
HTML/script in a less restrictive context
Potential Mitigations
Increase the entropy used to seed a PRNG.
Phases: Architecture and Design; Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [R.344.1] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Other Notes
This is often a factor in attacks on web browsers, in which known or
predictable filenames become necessary to exploit browser
vulnerabilities.
Weakness Ordinalities
Ordinality
Description
Primary
(where
the weakness exists independent of other weaknesses)
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
Description
