CWE一覧に戻る
CWE-341

観測可能な状態から予測可能な状態

Predictable from Observable State
脆弱性 レビュー中
JA

数字やオブジェクトは、時間やプロセスIDなど、システムやネットワークの状態について攻撃者が行うことができる観察に基づいて予測可能である。

EN

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

Scope: Other / Impact: Varies by Context
Increase the entropy used to seed a PRNG.
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.
MITRE公式ページ — CWE-341