DerScanner
Home / Vulnerability Database / C or C++ : Null initialization vector
C/C++

C or C++ : Null initialization vector

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic Failures
OWASP MASVS
V3: 3.3.(L1/L2/L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored Cryptography
PCI DSS 4.0
3.6.16.5.66.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-1032

Overview

The application performs encryption with null initialization vector (IV). In case of encrypting related messages with the same key an attacker can obtain information about the message. For secure encryption it is necessary for the IV to be cryptographically pseudorandom, that is, unpredictable to an attacker.

References

  1. CWE-329: Not Using a Random IV with CBC Mode
  2. Initialization vector - Wikipedia
  3. Forced into using a static IV (AES) - security.stackexchange.com
  4. Why should I use an Initialization Vector (IV) when I have unique keys? - crypto.stackexchange.com
  5. OWASP Top 10 2017-A3-Sensitive Data Exposure
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix C or C++ : Null initialization vector in your application?

See also

C/C++

C or C++ : Dead store

C/C++

C or C++ : Use after free

C/C++

C or C++ : va_list uninitialized