CVE-2002-0392

EPSS 95.0%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 95.0%KEV nãoPoC públicaNuclei —Metasploit simPatch referenciado

Lifecycle

17 Jun 2002Public PoC

19 Jun 2002Metasploit module available

02 Apr 2003Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/21559unverified exploitdbwww.exploit-db.com/exploits/21560unverified exploitdbwww.exploit-db.com/exploits/16782unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32 ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31 ftp://patches.sgi.com/support/free/security/advisories/20020605-01-A ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I http://archives.neohapsis.com/archives/bugtraq/2002-06/0235.html http://archives.neohapsis.com/archives/bugtraq/2002-06/0266.html http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000498 http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:039 http://httpd.apache.org/info/security_bulletin_20020617.txt http://online.securityfocus.com/advisories/4240 http://online.securityfocus.com/advisories/4257