PT-2002-1687 · Apache · Mod Ssl

Published 2002-07-11 · Updated 2024-02-02 · CVE-2002-0653

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod ssl Apache module versions 2.8.9 and earlier

Description The issue is related to an off-by-one buffer overflow in the ssl compat directive function, which is called by the rewrite command hook. This allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.

Recommendations For mod ssl Apache module versions 2.8.9 and earlier, consider updating to a version later than 2.8.9 to resolve the issue. As a temporary workaround, restrict access to .htaccess files to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2002-0653

DSA-135

Affected Products

Mod Ssl

References · 22

• 🔥 https://exploit-db.com/exploits/21575 · Exploit
• http://redhat.com/support/errata/RHSA-2002-134.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-146.html · Vendor Advisory
• http://debian.org/security/2002/dsa-135 · Vendor Advisory
• http://novell.com/linux/security/advisories/2002_028_mod_ssl.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-136.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000504 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-135.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-164.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0653 · Security Note
• http://redhat.com/support/errata/RHSA-2003-106.html · Vendor Advisory
• http://archives.neohapsis.com/archives/hp/2002-q3/0018.html · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-048.php · Vendor Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-031.0.txt · Vendor Advisory
• http://securityfocus.com/bid/5084 · Note