A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states This function wasnt used for security purposes (and is advertised as being unsuitable).
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG’s algorithm is not cryptographically strong.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Chicken | Call-cc | * | 4.8.0 (excluding) |
| Chicken | Ubuntu | hardy | * |
| Chicken | Ubuntu | lucid | * |
| Chicken | Ubuntu | oneiric | * |
| Chicken | Ubuntu | precise | * |
| Chicken | Ubuntu | quantal | * |
| Chicken | Ubuntu | upstream | * |
When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks. Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.