Unscored severity · published Jan 31, 2002
CVE-2002-0002
Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute arbitrary code
–
CVSS
5.3%
EPSS
No
On KEV
Description
Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Redhat
7.2 · source: NVD
ML
Mandrake Linux · Mandrakesoft
8.1 · source: NVD
SL
Secure Linux · Engardelinux
1.0.1 · source: NVD
ST
Stunnel · Stunnel
3.3; 3.4a; 3.7; 3.8; 3.9; 3.10; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0002
marc.info
http://marc.info/?l=stunnel-users&m=100869449828705&w=2
online.securityfocus.com
http://online.securityfocus.com/archive/1/247427
online.securityfocus.com
http://online.securityfocus.com/archive/1/248149
Vendor Advisory
http://stunnel.mirt.net/news.html
www.linux-mandrake.com
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-004.php3
Patch
http://www.redhat.com/support/errata/RHSA-2002-002.html
More from Secure Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
–
CVE-2004-0535
The e1000 driver for Linux kernel 2.4.26 and earlier does not properly initialize memory before using it, which allows local users to read portions of kernel memory
–
CVE-2003-0962
Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail
–
CVE-2001-0739
Guardian Digital WebTool in EnGarde Secure Linux 1.0.1 allows restarted services to inherit some environmental variables, which could allow local users to gain root privileges
–
CVE-2001-0736
Vulnerability in (1) pine before 4.33 and (2) the pico editor, included with pine, allows local users local users to overwrite arbitrary files via a symlink attack