PT-2002-1170 · Apache · Apache-Ssl+1

Publicado 2002-03-15 · Atualizado 2016-10-18 · CVE-2002-0082

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod ssl versions prior to 2.8.7-1.3.23 Apache-SSL versions prior to 1.3.22+1.46

Description The issue arises from improper memory initialization in the dbm and shm session cache code, allowing remote attackers to execute arbitrary code via a buffer overflow. This can be achieved by using a large client certificate signed by a trusted Certificate Authority (CA), resulting in a large serialized session.

Recommendations For mod ssl versions prior to 2.8.7-1.3.23, update to version 2.8.7-1.3.23 or later. For Apache-SSL versions prior to 1.3.22+1.46, update to version 1.3.22+1.46 or later.

Exploit

Correção

Identificadores relacionados

CVE-2002-0082

Produtos afetados

Apache-Ssl

Mod Ssl

Referências · 23

• 🔥 https://exploit-db.com/exploits/47080 · Exploit
• 🔥 https://exploit-db.com/exploits/21671 · Exploit
• 🔥 https://exploit-db.com/exploits/764 · Exploit
• http://online.securityfocus.com/archive/1/258646 · Nota
• http://securityfocus.com/advisories/3965 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0082 · Nota de Segurança
• http://securityfocus.com/bid/4189 · Nota
• http://redhat.com/support/errata/RHSA-2002-042.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0082 · Nota
• http://iss.net/security_center/static/8308.php · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2002-045.html · Aviso do Fabricante
• http://apacheweek.com/issues/02-03-01#security · Nota
• http://marc.info/?l=bugtraq&m=101518491916936&w=2 · Nota
• http://calderasystems.com/support/security/advisories/CSSA-2002-011.0.txt · Aviso do Fabricante
• http://packetstormsecurity.com/files/153567/Apache-mod_ssl-OpenSSL-Remote-Buffer-Overflow.html · Nota