Weakness (CWE)

CWE-341: Predictable from Observable State

Base Draft

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

How to prevent it (3 mitigations)

Implementation

Increase the entropy used to seed a PRNG.
Architecture and Design, Requirements

Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Implementation

Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Source: MITRE CWE-341

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.