CVE-2001-0950

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-331

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=100749428517090&w=2Exploit, Mailing List
http://www.securityfocus.com/bid/3618Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/3620Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.valicert.com/support/security_advisory_eva.htmlBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/7651Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/7653Third Party Advisory, VDB Entry
http://marc.info/?l=bugtraq&m=100749428517090&w=2Exploit, Mailing List
http://www.securityfocus.com/bid/3618Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/3620Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.valicert.com/support/security_advisory_eva.htmlBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/7651Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/7653Third Party Advisory, VDB Entry

Timeline

Published: Dec 4, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-09515.0Windows 2000 allows remote attackers to cause a denial of service (CPU consumption) by flooding Internet Key Exchange (IKE) UDP port 500 wit CVE-2001-09525.0THQ Volition Red Faction Game allows remote attackers to cause a denial of service (hang) of a client or server via packets to UDP port 7755 CVE-2001-095310.0Kebi WebMail allows remote attackers to access the administrator menu and gain privileges via the /a/ hidden directory, which is installed u CVE-2001-09545.0Lotus Domino 5.0.5 and 5.0.8, and possibly other versions, allows remote attackers to cause a denial of service (block access to databases t CVE-2001-09557.2Buffer overflow in fbglyph.c in XFree86 before 4.2.0, related to glyph clipping for large origins, allows attackers to cause a denial of ser CVE-2001-09567.2speechd 0.54 and earlier, with the Festival or rsynth speech synthesis package, allows attackers to execute arbitrary commands via shell met CVE-2001-09587.5Buffer overflows in eManager plugin for Trend Micro InterScan VirusWall for NT 3.51 and 3.51J allow remote attackers to execute arbitrary co CVE-2001-09596.4Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to CVE-2001-096010.0Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 stores the backup agent user name and password in cleartext in the aremo CVE-2001-096110.0Buffer overflow in tab expansion capability of the most program allows local or remote attackers to execute arbitrary code via a malformed f CVE-2001-09627.5IBM WebSphere Application Server 3.02 through 3.53 uses predictable session IDs for cookies, which allows remote attackers to gain privilege CVE-2001-09637.5Directory traversal vulnerability in SpoonFTP 1.1 allows local and sometimes remote attackers to access files outside of the FTP root via a