828
Potential Mitigations
Phase: Architecture and Design
Phase: Requirements
Strategy = Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy
problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Demonstrative Examples
Example 1:
The following XML example code is a deployment descriptor for a Java web application deployed
on a Sun Java Application Server. This deployment descriptor includes a session configuration
property for configuring the session ID length.
Example Language: XML (Bad)
<sun-web-app>
...
<session-config>
<session-properties>
<property name="idLengthBytes" value="8">
<description>The number of bytes in this web module's session ID.</description>
</property>
</session-properties>
</session-config>
...
</sun-web-app>
This deployment descriptor has set the session ID length for this Java web application to 8 bytes
(or 64 bits). The session ID length for Java web applications should be set to 16 bytes (128 bits) to
prevent attackers from guessing and/or stealing a session ID and taking over a user's session.
Note for most application servers including the Sun Java Application Server the session ID length is
by default set to 128 bits and should not be changed. And for many application servers the session
ID length cannot be changed from this default setting. Check your application server documentation
for the session ID length default setting and configuration options to ensure that the session ID
length is set to 128 bits.
Observed Examples
Reference Description
CVE-2002-0583 Product uses 5 alphanumeric characters for filenames of expense claim
reports, stored under web root.
https://www.cve.org/CVERecord?id=CVE-2002-0583
CVE-2002-0903 Product uses small number of random numbers for a code to approve an
action, and also uses predictable new user IDs, allowing attackers to hijack
new accounts.
https://www.cve.org/CVERecord?id=CVE-2002-0903
CVE-2003-1230 SYN cookies implementation only uses 32-bit keys, making it easier to brute
force ISN.
https://www.cve.org/CVERecord?id=CVE-2003-1230
CVE-2004-0230 Complex predictability / randomness (reduced space).
https://www.cve.org/CVERecord?id=CVE-2004-0230
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
CWE-335: Incorrect Usage of Seeds in
Pseudo-Random Number Generator (PRNG)