CVE-2003-0900

Step 1: Target Identification: The attacker identifies systems running Perl 5.8.1 on Fedora Core.

Step 2: Process Forking: The target application (e.g., a web server using Perl scripts) forks a new process.

Step 3: RNG State Inheritance: The child process inherits the RNG state from the parent process.

Step 4: Predictable Randomness: The child process uses the inherited RNG to generate 'random' numbers without re-seeding.

Step 5: Value Prediction: The attacker, knowing the RNG's state (or being able to determine it through observation), predicts the output of the RNG.

Step 6: Security Bypass: The attacker uses the predicted values (e.g., session IDs) to bypass security mechanisms, such as session hijacking or authentication bypass.

The vulnerability stems from a flaw in Perl's random number generator (RNG) initialization process when forking. When a process forks, it inherits the RNG state from its parent. If the RNG is not re-seeded in the child process, the child process will generate the same sequence of 'random' numbers as the parent, and any other child processes created from the same parent. This predictability allows attackers to guess values intended to be random, such as session IDs, authentication tokens, or cryptographic keys. The root cause is the lack of a call to a function like srand() with a unique seed (e.g., based on the current time and process ID) within the child process after the fork. This failure to re-seed the RNG leads to a deterministic sequence of pseudo-random numbers, making it vulnerable to attacks that rely on the unpredictability of random numbers.