What is CVE-2002-1568?

CVE-2002-1568 is a vulnerability in Openssl. Published 2003-11-17.

Is CVE-2002-1568 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Openssl

CVE-2002-1568

OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to cause a denial of service (crash) via certain messages that cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which are not properly handled in s2_srvr.c.

EPSS: 0.027 (84.6th percentile) — read the EPSS interpretation.

Affected products

Openssl — versions 0.9.6e
N/a — versions n/a

Public proof-of-concept exploits

ARPSyndicate/cvemon
Ananya-0306/vuln-finder
chnzzh/OpenSSL-CVE-lib
cve-search/git-vuln-finder

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)

Frequently asked questions

What is CVE-2002-1568?: CVE-2002-1568 is a vulnerability in Openssl. Published 2003-11-17.
Is CVE-2002-1568 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.