WebKit Insufficient Entropy Random Number Generator Weakness

Bugtraq ID:	44952
Class:	Design Error
CVE:	CVE-2010-3804
Remote:	Yes
Local:	No
Published:	Nov 18 2010 12:00AM
Updated:	Nov 22 2010 06:16PM
Credit:	Amit Klein of Trusteer
Vulnerable:	WebKit Open Source Project WebKit 0 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 4.1 Apple iPhone 4.0 Apple iPhone 3.2 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2
Not Vulnerable:	Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple iOS 4.2

WebKit Insufficient Entropy Random Number Generator Weakness

WebKit is prone to a random-number-generator weakness.

Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.

Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks.

NOTE: This issue was previously covered in BID 44938 (Apple Safari Prior to 5.0.3 and 4.1.3 Multiple Security Vulnerabilities) but has been given its own record to better document it.

WebKit Insufficient Entropy Random Number Generator Weakness

The following proofs-of-concept are available:

• /data/vulnerabilities/exploits/44952-1.html
• /data/vulnerabilities/exploits/44952-2.html

WebKit Insufficient Entropy Random Number Generator Weakness

Solution:
Updates are available. Please see the references for more information.


Apple Safari 5.0.2

• Apple Safari5.0.3SnowLeopard.dmg
  Safari for Mac OS X v10.6.4 and later
  http://www.apple.com/safari/download/


• Apple Safari5.0.3Leopard.dmg
  Safari for Mac OS X v10.5.8
  http://www.apple.com/safari/download/

Apple Safari 4.1.2

• Apple Safari4.1.3Tiger.dmg
  Safari for Mac OS X v10.4.11
  http://www.apple.com/safari/download/

Apple Safari 5.0.2 for Windows

• Apple APPLE-SA-2010-11-18-1Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2010-11-18-1SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

Apple Safari 4.1.2 for Windows

• Apple APPLE-SA-2010-11-18-1Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2010-11-18-1SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

WebKit Insufficient Entropy Random Number Generator Weakness

References:

• Apple Safari Homepage (Apple)
  
• Temporary_User_Tracking_in_Safari_for_Windows (Amit Klein)
  
• Apple Safari for Windows (4.0.2-4.0.5, 5.0-5.0.2) Math.random() predictability (Amit Klein )