Vulnerability in Apache-Ssl
CVE-2002-0082
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
EPSS: 0.299 (98.0th percentile) — read the EPSS interpretation.
Affected products
- Apache-ssl — versions 1.40, 1.41, 1.42
- Mod_ssl — versions 2.7.1, 2.8, 2.8.1
- N/a — versions n/a
Public proof-of-concept exploits
- anilkashyap01/Binary-Exploitation-and-Kernel-Escalation
- ratiros01/CVE-2002-0082
- Dekiridi/ZeroHealth-Corp-Vulnerability-Assessment-Project
- Nishant-Pall/Kioptrix-exploit
- 0xcybermonk/Kioptrix-Pentest-Report
- piyush-saurabh/exploits
- rosonsec/Exploits
- davincico/ChatGPT-2-HACKER
- Abdibimantara/Vulnerability-Asessment-Kioptrix-Level-1-Vulnhub
References
- cve@mitre.org (x_refsource_CALDERA, vendor-advisory)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_HP, vendor-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRAKE)
- cve@mitre.org (vendor-advisory, x_refsource_ENGARDE)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2002-0082?
- CVE-2002-0082 is a vulnerability in Apache-Ssl. Published 2002-03-15.
- Is CVE-2002-0082 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.