CVE-2001-0950

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2001-0950
ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://marc.info/?l=bugtraq&m=100749428517090&w=2 Exploit Mailing List
http://www.securityfocus.com/bid/3618 Broken Link Patch Third Party Advisory VDB Entry Vendor Advisory
http://www.securityfocus.com/bid/3620 Broken Link Patch Third Party Advisory VDB Entry Vendor Advisory
http://www.valicert.com/support/security_advisory_eva.html Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/7651 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/7653 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:valicert:enterprise_validation_authority:*:*:*:*:*:*:*:*
History

15 Feb 2024, 03:29

Type Values Removed Values Added
CWE NVD-CWE-Other CWE-331
CVSS v2 : 7.5
v3 : unknown 		v2 : 7.5
v3 : 7.5
References () http://marc.info/?l=bugtraq&m=100749428517090&w=2 - () http://marc.info/?l=bugtraq&m=100749428517090&w=2 - Exploit, Mailing List
References () http://www.securityfocus.com/bid/3618 - Patch, Vendor Advisory () http://www.securityfocus.com/bid/3618 - Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () http://www.securityfocus.com/bid/3620 - Patch, Vendor Advisory () http://www.securityfocus.com/bid/3620 - Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () http://www.valicert.com/support/security_advisory_eva.html - URL Repurposed () http://www.valicert.com/support/security_advisory_eva.html - Broken Link
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/7651 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/7651 - Third Party Advisory, VDB Entry
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/7653 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/7653 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:valicert:enterprise_validation_authority:3.8:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:3.3:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:3.7:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:4.0:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:3.4:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:4.1:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:3.6:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:4.2:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:3.9:*:*:*:*:*:*:*
cpe:2.3:a:valicert:enterprise_validation_authority:3.5:*:*:*:*:*:*:*		 cpe:2.3:a:valicert:enterprise_validation_authority:*:*:*:*:*:*:*:*

14 Feb 2024, 01:17

Type Values Removed Values Added
References () http://www.valicert.com/support/security_advisory_eva.html - () http://www.valicert.com/support/security_advisory_eva.html - URL Repurposed
Information

Published : 2001-12-04 05:00

Updated : 2024-02-15 03:29

NVD link : CVE-2001-0950

Mitre link : CVE-2001-0950

CVE.ORG link : CVE-2001-0950

JSON object : View

Products Affected

valicert

  • enterprise_validation_authority
CWE
CWE-331

Insufficient Entropy