DerScanner
Home / Vulnerability Database / C or C++ : Unsafe function: rand
C/C++

C or C++ : Unsafe function: rand

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
OWASP ASVS
Stored Cryptography
PCI DSS 4.0
3.6.16.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-1032

Overview

The application uses an insecure pseudo-random number generator (PRNG). The generated sequence of numbers is predictable. Examples of insecure PRNG: rand, drand48, erand48, jrand48, lcong48, lrand48, mrand48, nrand48, rand_r, random.

PRNGs generate number sequences based on the initial value of the seed. There are two types of PRNG: statistical and cryptographic. Statistical PRNGs generate predictable sequences, which are similar to random according to the statistical characteristics. They must not be used for security purposes. The result of the cryptographic PRNG, on the contrary, is impossible to predict if the value of seed is derived from a source with high entropy. The value of the current time has a small entropy and is also insecure as a seed.

These functions generate predictable sequences and must not be used for information security purposes.

References

  1. CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
  2. OWASP: Insecure randomness
  3. OWASP Top 10 2017-A3-Sensitive Data Exposure
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix C or C++ : Unsafe function: rand in your application?

See also

C/C++

C or C++ : Dead store

C/C++

C or C++ : Use after free

C/C++

C or C++ : va_list uninitialized