PT-2001-2102 · Valicert · Valicert Enterprise Validation Authority (Eva) Administration Server

Published 2001-12-04 · Updated 2024-02-14 · CVE-2001-0949

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ValiCert Enterprise Validation Authority (EVA) Administration Server versions 3.3 through 4.2.1

Description The issue allows remote attackers to execute arbitrary code via long arguments to various parameters, including Mode, Certificate File, useExpiredCRLs, listenLength, maxThread, maxConnPerSite, maxMsgLen, exitTime, blockTime, nextUpdatePeriod, buildLocal, maxOCSPValidityPeriod, extension, and a particular combination of parameters associated with private key generation.

Recommendations For ValiCert Enterprise Validation Authority (EVA) Administration Server versions 3.3 through 4.2.1, consider restricting access to the forms.exe CGI program to minimize the risk of exploitation. As a temporary workaround, limit the length of arguments passed to the vulnerable parameters until a patch is available.

Fix

Related Identifiers

CVE-2001-0949

Affected Products

Valicert Enterprise Validation Authority (Eva) Administration Server

References · 18

• http://valicert.com/support/security_advisory_eva.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0949 · Security Note
• http://securityfocus.com/bid/3621 · Vendor Advisory
• http://securityfocus.com/bid/3630 · Note
• http://securityfocus.com/bid/3627 · Note
• http://securityfocus.com/bid/3632 · Note
• http://securityfocus.com/bid/3629 · Note
• http://marc.info/?l=bugtraq&m=100749428517090&w=2 · Note
• http://securityfocus.com/bid/3631 · Note
• http://securityfocus.com/bid/3625 · Note
• http://securityfocus.com/bid/3633 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7652 · Note
• http://securityfocus.com/bid/3628 · Note
• http://securityfocus.com/bid/3634 · Note
• http://securityfocus.com/bid/3622 · Note