PT-2002-1170 · Apache · Apache-Ssl+1

Published 2002-03-15 · Updated 2016-10-18 · CVE-2002-0082

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod ssl versions prior to 2.8.7-1.3.23 Apache-SSL versions prior to 1.3.22+1.46

Description The issue arises from improper memory initialization in the dbm and shm session cache code, allowing remote attackers to execute arbitrary code via a buffer overflow. This can be achieved by using a large client certificate signed by a trusted Certificate Authority (CA), resulting in a large serialized session.

Recommendations For mod ssl versions prior to 2.8.7-1.3.23, update to version 2.8.7-1.3.23 or later. For Apache-SSL versions prior to 1.3.22+1.46, update to version 1.3.22+1.46 or later.

Exploit

Fix

Related Identifiers

CVE-2002-0082

Affected Products

Apache-Ssl

Mod Ssl

References · 23

• 🔥 https://exploit-db.com/exploits/47080 · Exploit
• 🔥 https://exploit-db.com/exploits/21671 · Exploit
• 🔥 https://exploit-db.com/exploits/764 · Exploit
• http://securityfocus.com/advisories/3965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0082 · Security Note
• http://redhat.com/support/errata/RHSA-2002-042.html · Vendor Advisory
• http://iss.net/security_center/static/8308.php · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-045.html · Vendor Advisory
• http://calderasystems.com/support/security/advisories/CSSA-2002-011.0.txt · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-041.html · Vendor Advisory
• http://debian.org/security/2002/dsa-120 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000465 · Vendor Advisory
• http://linuxsecurity.com/advisories/other_advisory-1923.html · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-020.php · Vendor Advisory
• http://securityfocus.com/advisories/4008 · Vendor Advisory