NetSight
IP …
high7.5Public exploit code

CVE-2002-0082

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SES…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Affected products

VendorProductAffected versions
Apache-SslApache-Ssl
Versions 1.40, 1.41, 1.42, 1.44, 1.45, 1.46
Mod SslMod Ssl
Versions 2.7.1, 2.8, 2.8.1, 2.8.2, 2.8.3, 2.8.4

References