PT-2002-1080 · Stunnel · Stunnel

Published 2002-01-31 · Updated 2017-10-10 · CVE-2002-0002

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions stunnel versions prior to 3.22

Description The issue allows remote malicious servers to execute arbitrary code when stunnel is used in client mode for protocols such as smtp, pop, or nntp. Exploitation of the vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For versions prior to 3.22, update to version 3.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of stunnel in client mode for smtp, pop, and nntp protocols until a patch is available.

Exploit

Fix

Related Identifiers

BDU:2015-08222

CVE-2002-0002

Affected Products

Stunnel

References · 12

• 🔥 https://exploit-db.com/exploits/21192 · Exploit
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-004.php3 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-002.html · Vendor Advisory
• http://stunnel.mirt.net/news.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0002 · Security Note
• https://bdu.fstec.ru/vul/2015-08222 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7741 · Note
• https://rhn.redhat.com/errata/RHSA-2003-221.html · Note
• http://marc.info/?l=stunnel-users&m=100869449828705&w=2 · Note
• http://securityfocus.com/bid/3748 · Note
• http://online.securityfocus.com/archive/1/248149 · Note
• http://online.securityfocus.com/archive/1/247427 · Note