National Cyber Awareness System

Vulnerability Summary for CVE-2001-0949

Overview

Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters (1) Mode, (2) Certificate_File, (3) useExpiredCRLs, (4) listenLength, (5) maxThread, (6) maxConnPerSite, (7) maxMsgLen, (8) exitTime, (9) blockTime, (10) nextUpdatePeriod, (11) buildLocal, (12) maxOCSPValidityPeriod, (13) extension, and (14) a particular combination of parameters associated with private key generation that form a string of a certain length.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: eva-forms-bo(7652)

Type: Advisory; Patch Information

Hyperlink:http://xforce.iss.net/static/7652.php

External Source: BID

Name: 3621

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/3621

External Source: CONFIRM

Name: http://www.valicert.com/support/security_advisory_eva.html

Type: Advisory

Hyperlink:http://www.valicert.com/support/security_advisory_eva.html

External Source: BID

Name: 3636

Hyperlink:http://www.securityfocus.com/bid/3636

External Source: BID

Name: 3635

Hyperlink:http://www.securityfocus.com/bid/3635

External Source: BID

Name: 3634

Hyperlink:http://www.securityfocus.com/bid/3634

External Source: BID

Name: 3633

Hyperlink:http://www.securityfocus.com/bid/3633

External Source: BID

Name: 3632

Hyperlink:http://www.securityfocus.com/bid/3632

External Source: BID

Name: 3631

Hyperlink:http://www.securityfocus.com/bid/3631

External Source: BID

Name: 3630

Hyperlink:http://www.securityfocus.com/bid/3630

External Source: BID

Name: 3629

Hyperlink:http://www.securityfocus.com/bid/3629

External Source: BID

Name: 3628

Hyperlink:http://www.securityfocus.com/bid/3628

External Source: BID

Name: 3627

Hyperlink:http://www.securityfocus.com/bid/3627

External Source: BID

Name: 3625

Hyperlink:http://www.securityfocus.com/bid/3625

External Source: BID

Name: 3624

Hyperlink:http://www.securityfocus.com/bid/3624

External Source: BID

Name: 3622

Hyperlink:http://www.securityfocus.com/bid/3622

External Source: BUGTRAQ

Name: 20011204 NMRC Advisory - Multiple Valicert Problems

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=100749428517090&w=2