Published: 15/03/2002 Updated: 18/10/2016

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 766

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The dbm and shm session cache code in mod_ssl prior to 2.8.7-1.3.23, and Apache-SSL prior to 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote malicious users to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache-ssl apache-ssl 1.45
apache-ssl apache-ssl 1.46
mod ssl mod ssl 2.8.5
mod ssl mod ssl 2.8.6
apache-ssl apache-ssl 1.42
apache-ssl apache-ssl 1.44
mod ssl mod ssl 2.8.3
mod ssl mod ssl 2.8.4
mod ssl mod ssl 2.7.1
mod ssl mod ssl 2.8
apache-ssl apache-ssl 1.40
apache-ssl apache-ssl 1.41
mod ssl mod ssl 2.8.1
mod ssl mod ssl 2.8.2

Ed Moyle recently found a buffer overflow in Apache-SSL and mod_ssl With session caching enabled, mod_ssl will serialize SSL session variables to store them for later use These variables were stored in a buffer of a fixed size without proper boundary checks To exploit the overflow, the server must be configured to require client certificates, an ...

/* * OF version r00t VERY PRIV8 spabam * Version: v304 * Requirements: libssl-dev * Compile with: gcc -o OpenFuck OpenFuckc -lcrypto * objdump -R /usr/sbin/httpd|grep free to get more targets * #hackarena ircbrasnetorg * Note: if required, host ptrace and replace wget target */ #include <arpa/ineth> #include <netinet/inh&g ...

/* source: wwwsecurityfocuscom/bid/5363/info A buffer-overflow vulnerability has been reported in some versions of OpenSSL The issue occurs in the handling of the client key value during the negotiation of the SSLv2 protocol A malicious client may be able to exploit this vulnerability to execute arbitrary code as the vulnerable server ...

/* * E-DB Note: Updating OpenFuck Exploit ~ paulsecgithubio/blog/2014/04/14/updating-openfuck-exploit/ * * OF version r00t VERY PRIV8 spabam * Compile with: gcc -o OpenFuck OpenFuckc -lcrypto * objdump -R /usr/sbin/httpd|grep free to get more targets * #hackarena ircbrasnetorg */ #include <arpa/ineth> #include <netinet ...

Vulnerability-Asessment-Kioptrix-Level-1-Vulnhub Repositori ini saya create untuk mendokumentasikan proses Vulnerability Assesment dari mesin Kioptirxi Level 1 dari platform Vulhub Link Source Mesin Kioptrik Level 1 dari vulnhub dapat didownload secara free pada website resminya di link : wwwvulnhubcom/entry/kioptrix-level-1-1,22/ Persiapan Virtualbox : www

KIOPTRIX REPORT Kioptrix (192168118) nmap Nmap scan report for 192168118 Host is up (000012s latency) Not shown: 65529 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 29p2 (protocol 199) | ssh-hostkey: | 1024 b8:74:6c:db:fd:8b:e6:66:e9:2a:2b:df:5e:6f:64:86 (RSA1) | 1024 8f:8e:5b:81:ed:21:ab:c1:80:e1:57:a3:3c:85:c4:71 (DSA) |_ 1024 ed:4e:a9:4a:06:14:ff:

Public exploits and modifications

Exploits Public exploits modifications CVE-2002-0082 Apache mod_ssl < 287 OpenSSL - OpenFuckV2c Remote Buffer Overflow Fixes compilation errors CVE-2009-3103 Remote Code Execution via "SMBv2 Negotiation Vulnerability" Fixes compilation errors CVE-2017-0143 aka MS17-010 Remote Code Execution vulnerability in Microsoft SMBv1 Fixes compilation errors CVE-2003-

NVD-CWE-Other http://www.iss.net/security_center/static/8308.php http://www.apacheweek.com/issues/02-03-01#security http://online.securityfocus.com/archive/1/258646 http://www.linuxsecurity.com/advisories/other_advisory-1923.html http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000465 http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-020.php http://www.redhat.com/support/errata/RHSA-2002-041.html http://www.redhat.com/support/errata/RHSA-2002-042.html http://www.redhat.com/support/errata/RHSA-2002-045.html http://www.debian.org/security/2002/dsa-120 http://www.securityfocus.com/advisories/3965 http://www.securityfocus.com/advisories/4008 http://www.calderasystems.com/support/security/advisories/CSSA-2002-011.0.txt http://ftp.support.compaq.com/patches/.new/html/SSRT0817.shtml http://www.securityfocus.com/bid/4189 http://marc.info/?l=bugtraq&m=101518491916936&w=2 http://marc.info/?l=bugtraq&m=101528358424306&w=2 http://packetstormsecurity.com/files/153567/Apache-mod_ssl-OpenSSL-Remote-Buffer-Overflow.html https://nvd.nist.gov https://www.debian.org/security/./dsa-120 https://github.com/rosonsec/Exploits https://www.exploit-db.com/exploits/47080 https://www.kb.cert.org/vuls/id/234971

CVE-2002-0082

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect