目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-330 使用不充分的随机数 类漏洞列表 125

CWE-330 使用不充分的随机数 类弱点 125 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-330属于密码学相关漏洞，指在依赖不可预测数值的安全场景中使用了随机性不足的数值。攻击者通常通过分析伪随机数生成器的弱点，预测或重现关键值，从而绕过身份验证或会话管理。开发者应避免使用标准库中的伪随机函数处理敏感数据，转而采用操作系统提供的加密安全随机数生成器，并确保种子来源具备足够的熵，以保障数值不可预测性。

MITRE CWE 官方描述
CWE：CWE-330 使用不足够随机的值 (Use of Insufficiently Random Values) 英文：产品在一个依赖于不可预测数字的安全上下文中使用了不足够随机的数字或值。
常见影响 (3)
Confidentiality, OtherOther
When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.
Access Control, OtherBypass Protection Mechanism, Other
If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the…
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.
缓解措施 (3)
Architecture and DesignUse a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce…
ImplementationConsider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and Design, RequirementsUse products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
代码示例 (2)
This code attempts to generate a unique random identifier for a user's session.
function generateSessionID($userID){ srand($userID); return rand(); }
Bad · PHP
The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.
String GenerateReceiptURL(String baseUrl) { Random ranGen = new Random(); ranGen.setSeed((new Date()).getTime()); return(baseUrl + ranGen.nextInt(400000000) + ".html"); }
Bad · Java
CVE ID标题CVSS风险等级Published
CVE-2018-13280 Synology DiskStation Manager 安全漏洞 — DiskStation Manager (DSM) 7.4 -2018-07-30
CVE-2017-16028 react-native-meteor-oauth 安全漏洞 — react-native-meteor-oauth node module 7.5 -2018-06-04
CVE-2018-1108 Linux kernel驱动程安全特征问题漏洞 — drivers 6.5 -2018-05-21
CVE-2017-6026 Schneider Electric Modicon PLCs Modicon M241和Modicon M251 安全特征问题漏洞 — Schneider Electric Modicon PLCs 9.1 -2017-06-30
CVE-2017-0897 EllisLab ExpressionEngine 安全漏洞 — ExpressionEngine 7.5 -2017-06-22

CWE-330（使用不充分的随机数） 是常见的弱点类别，本平台收录该类弱点关联的 125 条 CVE 漏洞。