VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 9, 2019· Updated Aug 6, 2024

CVE-2013-0342

CVE-2013-0342

Description

The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pyradPyPI
< 2.12.1

Affected products

1

Patches

1
38f74b36814c

Use a better random generator.

https://github.com/pyradius/pyradWichert AkkermanJan 15, 2013via ghsa
commit
2 files changed · +13 −3
  • CHANGES.txt+7 −0 modified
    @@ -1,6 +1,13 @@
 Changelog
 =========
 
+2.1 - Unreleased
+------------------
+
+* Use a different random generator to improve the security of generated
+  packet ids and authenticators.
+
+
 2.0 - May 15, 2011
 ------------------
  • pyrad/packet.py+6 −3 modified
    @@ -33,8 +33,11 @@
 CoAACK = 44
 CoANAK = 45
 
+# Use cryptographic-safe random generator as provided by the OS.
+random_generator = random.SystemRandom()
+
 # Current ID
-CurrentID = random.randrange(1, 255)
+CurrentID = random_generator.randrange(1, 255)
 
 
 class PacketError(Exception):
@@ -208,7 +211,7 @@ def CreateAuthenticator():
 
         data = []
         for i in range(16):
-            data.append(random.randrange(0, 256))
+            data.append(random_generator.randrange(0, 256))
         if six.PY3:
             return bytes(data)
         else:
@@ -223,7 +226,7 @@ def CreateID(self):
         :rtype:  integer
 
         """
-        return random.randrange(0, 256)
+        return random_generator.randrange(0, 256)
 
     def ReplyPacket(self):
         """Create a ready-to-transmit authentication reply packet.

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.