CVE-2002-0082

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Affected Software

Name	Vendor	Start Version	End Version
Apache-ssl	Apache-ssl	1.40 (including)	1.40 (including)
Apache-ssl	Apache-ssl	1.41 (including)	1.41 (including)
Apache-ssl	Apache-ssl	1.42 (including)	1.42 (including)
Apache-ssl	Apache-ssl	1.44 (including)	1.44 (including)
Apache-ssl	Apache-ssl	1.45 (including)	1.45 (including)
Apache-ssl	Apache-ssl	1.46 (including)	1.46 (including)
Mod_ssl	Mod_ssl	2.7.1 (including)	2.7.1 (including)
Mod_ssl	Mod_ssl	2.8 (including)	2.8 (including)
Mod_ssl	Mod_ssl	2.8.1 (including)	2.8.1 (including)
Mod_ssl	Mod_ssl	2.8.2 (including)	2.8.2 (including)
Mod_ssl	Mod_ssl	2.8.3 (including)	2.8.3 (including)
Mod_ssl	Mod_ssl	2.8.4 (including)	2.8.4 (including)
Mod_ssl	Mod_ssl	2.8.5 (including)	2.8.5 (including)
Mod_ssl	Mod_ssl	2.8.6 (including)	2.8.6 (including)
Red Hat Linux 7.0	RedHat		*
Red Hat Linux 7.1	RedHat		*
Red Hat Linux 7.2	RedHat		*
Red Hat Secure Web Server 3.2	RedHat		*
Red Hat Stronghold 3	RedHat		*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2002-0082
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References