CVE-2002-0082

Apache-ssl - Buffer Overflow

Title source: rule

Description

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Exploits (5)

exploitdb WORKING POC VERIFIED
by spabam · cremoteunix
https://www.exploit-db.com/exploits/764
exploitdb WORKING POC VERIFIED
by spabam · cremoteunix
https://www.exploit-db.com/exploits/21671
exploitdb WORKING POC
by Brian Peters · cremoteunix
https://www.exploit-db.com/exploits/47080
nomisec WRITEUP
by anilkashyap01 · poc
https://github.com/anilkashyap01/Binary-Exploitation-and-Kernel-Escalation
nomisec WORKING POC
by ratiros01 · poc
https://github.com/ratiros01/CVE-2002-0082

Scores

EPSS 0.0287
EPSS Percentile 86.3%

Details

Status published
Products (14)
apache-ssl/apache-ssl 1.40
apache-ssl/apache-ssl 1.41
apache-ssl/apache-ssl 1.42
apache-ssl/apache-ssl 1.44
apache-ssl/apache-ssl 1.45
apache-ssl/apache-ssl 1.46
mod_ssl/mod_ssl 2.7.1
mod_ssl/mod_ssl 2.8
mod_ssl/mod_ssl 2.8.1
mod_ssl/mod_ssl 2.8.2
... and 4 more
Published Mar 15, 2002
Tracked Since Feb 18, 2026