CVE-2002-0653: modssl mod_ssl Off-by-one Error
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2002-0653 is a high (CVSS 7.8) Off-by-one Error vulnerability in modssl mod_ssl. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (exploit-database, 22-06-2002)
Source freshness unavailable
How is this decided?Timeline
- 02-04-2003PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.14%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 1.10% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundApache mod_ssl 2.8.x - Off-by-One HTAccess Buffer Overflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- libapache-mod-ssl< 2.8.9-2
Modssl1 product
- mod_ssl≤ 2.8.9
2 vendors · 2 products
References
17 links- distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000504Vendor AdvisoryX Refsource CONECTIVABroken Link
- www.linux-mandrake.com/en/security/2002/MDKSA-2002-048.phpVendor AdvisoryX Refsource MANDRAKEBroken Link
- www.novell.com/linux/security/advisories/2002_028_mod_ssl.htmlVendor AdvisoryX Refsource SUSEBroken Link
