Skip to content
OpenAdvisories
Unscored Public exploit CVE-2002-0082 EUVD-2002-0082GHSA-4fj5-x3ch-mc34

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory u…

Published Jun 25, 2002 · Updated Aug 8, 2024 · Assigned by mitre

Description

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 3

GitHub 3 repositories

  • anilkashyap01/Binary-Exploitation-and-Kernel-Escalation ★ 1 · Apr 15, 2026

    Secured root-level access by identifying and exploiting misconfigurations and outdated software. Buffer overflow vulnerability in an outdated version of mod_ssl (CVE-2002-0082). Privilege escalation …

  • Nutsulejustine/pentest-kioptrix ★ 0 · Oct 13, 2026

    Test d’intrusion sur Kioptrix Level 1 : exploitation d’une faille Apache/mod_ssl (OpenFuck, CVE-2002-0082) jusqu’à l’accès root, en environnement de laboratoire isolé.

  • ratiros01/CVE-2002-0082 ★ 0 · Mar 24, 2025

    CVE-2002-0082

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References