837
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Background Details
Computers are deterministic machines, and as such are unable to produce true randomness.
Pseudo-Random Number Generators (PRNGs) approximate randomness algorithmically, starting
with a seed from which subsequent values are calculated. There are two types of PRNGs:
statistical and cryptographic. Statistical PRNGs provide useful statistical properties, but their
output is highly predictable and forms an easy to reproduce numeric stream that is unsuitable for
use in cases where security depends on generated values being unpredictable. Cryptographic
PRNGs address this problem by generating output that is more difficult to predict. For a value to be
cryptographically secure, it must be impossible or highly improbable for an attacker to distinguish
between it and a truly random value.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality
Other
Other
When a protection mechanism relies on random values to
restrict access to a sensitive resource, such as a session
ID or a seed for generating a cryptographic key, then the
resource being protected could be accessed by guessing
the ID or key.
Access Control
Other
Bypass Protection Mechanism
Other
If product relies on unique, unguessable IDs to identify a
resource, an attacker might be able to guess an ID for a
resource that is owned by another user. The attacker could
then read the resource, or pre-create a resource with the
CWE Version 4.14
CWE-330: Use of Insufficiently Random Values
CWE-330: Use of Insufficiently Random Values