CVE-2002-0656 Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL...
HighCVSS 7.5
EPSS 89.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSL | = 0.9.1c | No fix listed |
| OpenSSL | = 0.9.2b | No fix listed |
| OpenSSL | = 0.9.3 | No fix listed |
| OpenSSL | = 0.9.4 | No fix listed |
| OpenSSL | = 0.9.5 | No fix listed |
| OpenSSL | = 0.9.5a | No fix listed |
| OpenSSL | = 0.9.6 | No fix listed |
| OpenSSL | = 0.9.6a | No fix listed |
| OpenSSL | = 0.9.6b | No fix listed |
| OpenSSL | = 0.9.6c | No fix listed |
| OpenSSL | = 0.9.6d | No fix listed |
| OpenSSL | = 0.9.7-beta1 | No fix listed |
| OpenSSL | = 0.9.7-beta2 | No fix listed |
| oracle application server | All versions | No fix listed |
| oracle application server | = 1.0.2 | No fix listed |
| oracle application server | = 1.0.2.1s | No fix listed |
| oracle application server | = 1.0.2.2 | No fix listed |
| oracle corporate time outlook connector | = 3.1 | No fix listed |
| oracle corporate time outlook connector | = 3.1.1 | No fix listed |
| oracle corporate time outlook connector | = 3.1.2 | No fix listed |
| oracle corporate time outlook connector | = 3.3 | No fix listed |
| oracle http server | = 9.0.1 | No fix listed |
| oracle http server | = 9.2.0 | No fix listed |
| apple mac os x | = 10.0 | No fix listed |
| apple mac os x | = 10.0.1 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apple mac os x | = 10.0.2 | No fix listed |
| apple mac os x | = 10.0.3 | No fix listed |
| apple mac os x | = 10.0.4 | No fix listed |
| apple mac os x | = 10.1 | No fix listed |
| apple mac os x | = 10.1.1 | No fix listed |
| apple mac os x | = 10.1.2 | No fix listed |
| apple mac os x | = 10.1.3 | No fix listed |
| apple mac os x | = 10.1.4 | No fix listed |
| apple mac os x | = 10.1.5 | No fix listed |
| debian/openssl(Debian:12) | < 0.9.6e-1 | 0.9.6e-1 |
| debian/openssl(Debian:13) | < 0.9.6e-1 | 0.9.6e-1 |
| debian/openssl(Debian:14) | < 0.9.6e-1 | 0.9.6e-1 |
References
- CLA-2002:513 vendor-advisory
- CA-2002-23 third-party-advisory us-government-resource
- openssl-ssl2-masterkey-bo(9714) vdb-entry
- openssl-ssl3-sessionid-bo(9716) vdb-entry
- VU#102795 third-party-advisory us-government-resource
- VU#258555 third-party-advisory us-government-resource
- MDKSA-2002:046 vendor-advisory
- 5362 vdb-entry
- 5363 vdb-entry
- Debian Security Tracker CVE-2002-0656 vendor-advisory