CVE-2002-0082Apache-SSL Vulnerability
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client…
Published Feb 27, 2002 · Updated Aug 8, 2024
Key Facts
Patch immediately- CVE-2002-0082 is a high-severity vulnerability (CVSS 7.5 v2) affecting Apache-SSL, Mod SSL.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 30% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
30%
Higher than 98.1% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
47/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
3
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryRHSA-2002:041
- advisoryRHSA-2002:042
- advisoryRHSA-2002:045
- patchapache-modssl-bo(8308)
Description
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
Affected Products
14 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Apache-SSLApache-SSL | 1.40, 1.41, 1.42, 1.44, 1.45, 1.46 | n/a |
| Mod SSLMod SSL | 2.7.1, 2.8, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5, 2.8.6 | n/a |
Timeline
Publicly disclosed
Feb 27, 2002
Last updated
Aug 8, 2024
References
- advisoryRHSA-2002:041
- advisoryRHSA-2002:042
- advisoryRHSA-2002:045
- patchapache-modssl-bo(8308)
- exploitExploitDB-21671
FAQ
Common Questions.
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certi…
Affected: Apache-SSL versions 1.40, 1.41, 1.42, 1.44, 1.45, 1.46; Mod SSL versions 2.7.1, 2.8, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5, 2.8.6. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2002-0082 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo