Description
Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters (1) Mode, (2) Certificate_File, (3) useExpiredCRLs, (4) listenLength, (5) maxThread, (6) maxConnPerSite, (7) maxMsgLen, (8) exitTime, (9) blockTime, (10) nextUpdatePeriod, (11) buildLocal, (12) maxOCSPValidityPeriod, (13) extension, and (14) a particular combination of parameters associated with private key generation that form a string of a certain length.
References
- 3634 vdb-entry
- 3631 vdb-entry
- 3635 vdb-entry
- 3628 vdb-entry
- 3625 vdb-entry
- 3636 vdb-entry
- 20011204 NMRC Advisory - Multiple Valicert Problems mailing-list
- 3633 vdb-entry
- 3630 vdb-entry
- http://www.valicert.com/support/security_advisory_eva.html
- 3629 vdb-entry
- 3621 vdb-entry
- 3622 vdb-entry
- 3627 vdb-entry
- 3632 vdb-entry
- 3624 vdb-entry
- eva-forms-bo(7652) vdb-entry