Login Request a demo
Unscored severity · published May 12, 2003
CVE-2002-1563
stunnel 4.0.3 and earlier allows attackers to cause a denial of service (crash) via SIGCHLD signal handler race conditions that cause an inconsistency in the child counter
–
CVSS
0.3%
EPSS
No
On KEV
Description
stunnel 4.0.3 and earlier allows attackers to cause a denial of service (crash) via SIGCHLD signal handler race conditions that cause an inconsistency in the child counter.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Stunnel · Stunnel
4.04 · source: NVD
Affected product
ST
Stunnel
Stunnel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1563
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1563
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000736
marc.info
http://marc.info/?l=bugtraq&m=104247606910598
marc.info
http://marc.info/?l=bugtraq&m=106029168514511&w=2
marc.info
http://marc.info/?l=stunnel-users&m=103600188215117&w=2
www.linuxsecurity.com
http://www.linuxsecurity.com/advisories/engarde_advisory-3535.html
Patch
http://www.redhat.com/support/errata/RHSA-2003-221.html
More from Stunnel
7.5
CVE-2021-20230
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options
–
CVE-2015-3644
Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers…
–
CVE-2014-0016
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the…
–
CVE-2013-1762
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers…
–
CVE-2011-2940
stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors