834
ParentOf 339 Small Seed Space in PRNG 840
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 330 Use of Insufficiently Random Values 814
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1213 Random Number Issues 2477
MemberOf 310 Cryptographic Issues 2318
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Other
Bypass Protection Mechanism
Other
If a PRNG is used incorrectly, such as using the same
seed for each initialization or using a predictable seed,
then an attacker may be able to easily guess the seed and
thus the random numbers. This could lead to unauthorized
access to a system if the seed is used for authentication
and authorization.
Demonstrative Examples
Example 1:
The following code uses a statistical PRNG to generate account IDs.
Example Language: Java (Bad)
private static final long SEED = 1234567890;
CWE Version 4.14
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
CWE-335: Incorrect Usage of Seeds in
Pseudo-Random Number Generator (PRNG)