CVE-2013-0294 (published 2020-01-28T16:15Z)

packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-330
cwe_name: Use of Insufficiently Random Values
description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
extended_description: When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
         

Fix information:
repo_url: https://github.com/wichert/pyrad
commit_details: repo_url: https://github.com/wichert/pyrad
author: Wichert Akkerman
author_date: 2013-01-15 16:55:54+01:00
msg: Use a better random generator.
repository: repo_url: https://github.com/wichert/pyrad
repo_name: pyradius/pyrad
description: Python RADIUS Implementation
repo_language: Python
owner: wichert
file_changes: filename: CHANGES.txt
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,13 @@
 Changelog
 =========
 
+2.1 - Unreleased
+------------------
+
+* Use a different random generator to improve the security of generated
+  packet ids and authenticators.
+
+
 2.0 - May 15, 2011
 ------------------
 

programming_language: Markdown
filename: packet.py
change_type: ModificationType.MODIFY
diff: @@ -33,8 +33,11 @@ CoARequest = 43
 CoAACK = 44
 CoANAK = 45
 
+# Use cryptographic-safe random generator as provided by the OS.
+random_generator = random.SystemRandom()
+
 # Current ID
-CurrentID = random.randrange(1, 255)
+CurrentID = random_generator.randrange(1, 255)
 
 
 class PacketError(Exception):
@@ -208,7 +211,7 @@ class Packet(dict):
 
         data = []
         for i in range(16):
-            data.append(random.randrange(0, 256))
+            data.append(random_generator.randrange(0, 256))
         if six.PY3:
             return bytes(data)
         else:
@@ -223,7 +226,7 @@ class Packet(dict):
         :rtype:  integer
 
         """
-        return random.randrange(0, 256)
+        return random_generator.randrange(0, 256)
 
     def ReplyPacket(self):
         """Create a ready-to-transmit authentication reply packet.

programming_language: Python
filename: CHANGES.txt
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,13 @@
 Changelog
 =========
 
+2.1 - Unreleased
+------------------
+
+* Use a different random generator to improve the security of generated
+  packet ids and authenticators.
+
+
 2.0 - May 15, 2011
 ------------------
 

programming_language: Markdown
filename: packet.py
change_type: ModificationType.MODIFY
diff: @@ -33,8 +33,11 @@ CoARequest = 43
 CoAACK = 44
 CoANAK = 45
 
+# Use cryptographic-safe random generator as provided by the OS.
+random_generator = random.SystemRandom()
+
 # Current ID
-CurrentID = random.randrange(1, 255)
+CurrentID = random_generator.randrange(1, 255)
 
 
 class PacketError(Exception):
@@ -208,7 +211,7 @@ class Packet(dict):
 
         data = []
         for i in range(16):
-            data.append(random.randrange(0, 256))
+            data.append(random_generator.randrange(0, 256))
         if six.PY3:
             return bytes(data)
         else:
@@ -223,7 +226,7 @@ class Packet(dict):
         :rtype:  integer
 
         """
-        return random.randrange(0, 256)
+        return random_generator.randrange(0, 256)
 
     def ReplyPacket(self):
         """Create a ready-to-transmit authentication reply packet.

programming_language: Python