CVE ID:	CVE-2002-0082
Description:	The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
Test IDs:	1.3.6.1.4.1.25623.1.0.10918   1.3.6.1.4.1.25623.1.0.10888
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2002-0082 BugTraq ID: 4189 http://www.securityfocus.com/bid/4189 Bugtraq: 20020227 mod_ssl Buffer Overflow Condition (Update Available) (Google Search) http://online.securityfocus.com/archive/1/258646 Bugtraq: 20020228 TSLSA-2002-0034 - apache (Google Search) Bugtraq: 20020301 Apache-SSL buffer overflow (fix available) (Google Search) http://marc.info/?l=bugtraq&m=101518491916936&w=2 Bugtraq: 20020304 Apache-SSL 1.3.22+1.47 - update to security fix (Google Search) http://marc.info/?l=bugtraq&m=101528358424306&w=2 Caldera Security Advisory: CSSA-2002-011.0 http://www.calderasystems.com/support/security/advisories/CSSA-2002-011.0.txt COMPAQ Service Security Patch: SSRT0817 http://ftp.support.compaq.com/patches/.new/html/SSRT0817.shtml Conectiva Linux advisory: CLA-2002:465 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000465 Debian Security Information: DSA-120 (Google Search) http://www.debian.org/security/2002/dsa-120 En Garde Linux Advisory: ESA-20020301-005 http://www.linuxsecurity.com/advisories/other_advisory-1923.html HPdes Security Advisory: HPSBTL0203-031 http://www.securityfocus.com/advisories/3965 HPdes Security Advisory: HPSBUX0204-190 http://www.securityfocus.com/advisories/4008 http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-020.php http://packetstormsecurity.com/files/153567/Apache-mod_ssl-OpenSSL-Remote-Buffer-Overflow.html RedHat Security Advisories: RHSA-2002:041 http://www.redhat.com/support/errata/RHSA-2002-041.html RedHat Security Advisories: RHSA-2002:042 http://www.redhat.com/support/errata/RHSA-2002-042.html RedHat Security Advisories: RHSA-2002:045 http://www.redhat.com/support/errata/RHSA-2002-045.html XForce ISS Database: apache-modssl-bo(8308) http://www.iss.net/security_center/static/8308.php