844
Nature Type ID Name Page
ChildOf 340 Generation of Predictable Numbers or Identifiers 842
PeerOf 339 Small Seed Space in PRNG 840
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1213 Random Number Issues 2477
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
This weakness could be exploited by an attacker in a
number ways depending on the context. If a predictable
number is used to generate IDs or keys that are used
within protection mechanisms, then an attacker could
gain unauthorized access to the system. If predictable
filenames are used for storing sensitive information, then
an attacker might gain access to the system and may be
able to gain access to the information in the file.
Potential Mitigations
Phase: Implementation
Increase the entropy used to seed a PRNG.
Phase: Architecture and Design
Phase: Requirements
Strategy = Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy
problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Phase: Implementation
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as
hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy
source might block.
Demonstrative Examples
Example 1:
This code generates a unique random identifier for a user's session.
Example Language: PHP (Bad)
function generateSessionID($userID){
srand($userID);
return rand();
}
Because the seed for the PRNG is always the user's ID, the session ID will always be the same. An
attacker could thus predict any user's session ID and potentially hijack the session.
CWE Version 4.14
CWE-342: Predictable Exact Value from Previous Values
CWE-342: Predictable Exact Value from Previous Values