846
Structure : Simple
Abstraction : Base
Description
An exact value or random number can be precisely predicted by observing previous values.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 340 Generation of Predictable Numbers or Identifiers 842
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1213 Random Number Issues 2477
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Increase the entropy used to seed a PRNG.
Phase: Architecture and Design
Phase: Requirements
Strategy = Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy
problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Phase: Implementation
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as
hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy
source might block.
Observed Examples
Reference Description
CVE-2002-1463 Firewall generates easily predictable initial sequence numbers (ISN), which
allows remote attackers to spoof connections.
https://www.cve.org/CVERecord?id=CVE-2002-1463
CVE-1999-0074 Listening TCP ports are sequentially allocated, allowing spoofing attacks.
https://www.cve.org/CVERecord?id=CVE-1999-0074
CVE-1999-0077 Predictable TCP sequence numbers allow spoofing.
https://www.cve.org/CVERecord?id=CVE-1999-0077
CVE-2000-0335 DNS resolver uses predictable IDs, allowing a local user to spoof DNS query
results.
https://www.cve.org/CVERecord?id=CVE-2000-0335
MemberOf Relationships
CWE Version 4.14
CWE-343: Predictable Value Range from Previous Values
CWE-343: Predictable Value Range from Previous Values