816
Scope Impact Likelihood
same ID to prevent the legitimate program from properly
sending the resource to the intended user. For example, a
product might maintain session information in a file whose
name is based on a username. An attacker could precreate
this file for a victim user, then set the permissions
so that the application cannot generate the session for the
victim, preventing the victim from using the application.
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
When an authorization or authentication mechanism
relies on random values to restrict access to restricted
functionality, such as a session ID or a seed for generating
a cryptographic key, then an attacker may access the
restricted functionality by guessing the ID or key.
Detection Methods
Black Box
Use monitoring tools that examine the software's process as it interacts with the operating
system and the network. This technique is useful in cases when source code is unavailable, if the
software was not developed by you, or if you want to verify that the build phase did not introduce
any new weaknesses. Examples include debuggers that directly attach to the running process;
system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors
such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and
sniffers and protocol analyzers that monitor network traffic. Attach the monitor to the process
and look for library functions that indicate when randomness is being used. Run the process
multiple times to see if the seed changes. Look for accesses of devices or equivalent resources
that are commonly used for strong (or weak) randomness, such as /dev/urandom on Linux. Look
for library or system calls that access predictable information such as process IDs and system
time.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Man-in-the-middle attack tool
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review
(not inspections)
Effectiveness = High
CWE Version 4.14
CWE-330: Use of Insufficiently Random Values
CWE-330: Use of Insufficiently Random Values