Vulnerability CVE-2001-0950
Published: 2001-12-04   Modified: 2012-02-12

Description:
ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Valicert -> Enterprise validation authority 

 References:
http://marc.info/?l=bugtraq&m=100749428517090&w=2
http://www.securityfocus.com/bid/3618
http://www.securityfocus.com/bid/3620
http://www.valicert.com/support/security_advisory_eva.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/7651
https://exchange.xforce.ibmcloud.com/vulnerabilities/7653
Copyright 2024, cxsecurity.com

 

Back to Top