SSLV2 Handshake malformed key buffer overflow in OpenSSL - CVE-2002-0656

Vulnerability identifier: #VU245

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2002-0656

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in OpenSSL. A remote unauthenticated attacker can execute arbitrary code by sending a large client master key in SSL2 or a large session ID in SSL3.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

OpenSSL

Upgrade your version to OpenSSL 0.9.6e.

• Exploit #373 - Apache mod_ssl OpenSSL < 0.9.6d / < 0.9.7-beta2 - 'openssl-too-open.c' SSL2 KEY_ARG Overflow Exploit (March 18, 2020)

• https://www.openssl.org/news/vulnerabilities.html#y2002

• SSLV2 Handshake malformed key buffer overflow in OpenSSL