CVE-2002-0653

mediumpriority · track · 41EPSS 0.011 · 66 %ileexploit · functionalEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · functional

Likely / severe?

1.14% (66th) EPSS

CVSS 4.6 · medium

Is it mine?

10 products

Check your exposure

Who says so?

3 sources

enisa_euvd · nvd · redhat_csaf

EPSS · scored 2026-10-23

Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRed Hat Linux 7.0redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpd restart
https://access.redhat.com/errata/RHSA-2002:134
FixedRed Hat Linux 7.1redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpd restart
https://access.redhat.com/errata/RHSA-2002:134
FixedRed Hat Linux 7.2redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpd restart
https://access.redhat.com/errata/RHSA-2002:134
FixedRed Hat Linux 7.3redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpd restart
https://access.redhat.com/errata/RHSA-2002:134
FixedRed Hat Secure Web Server 3.2redhat_csaf
Some of these files are distributed in rhmask format and may only be used by individuals who have purchased Red Hat Linux 6.2 Professional. To produce installable RPM files from the rhmask files, retrieve the rhmask files via ftp and type the following command: rhmask secureweb-3.2-12.i386.rpm secureweb-3.2.7-1.i386.rpm.rhmask The original RPM is located only on your Secure Web Server CD and cannot be obtained via the Internet. Note: If you do not have the original RPM located in the same directory as the rhmask file, you will need to prefix the name of the RPM with the full path name to its location (for example, on your installation CD). Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpsd restart
https://access.redhat.com/errata/RHSA-2002:135
FixedRed Hat Enterprise Linux AS (Advanced Server) version 2.1 redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpd restart
https://access.redhat.com/errata/RHSA-2002:136
FixedStronghold 4 for Red Hat Enterprise Linuxredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. After the appropriate updates have been applied, it will be necessary to manually restart the server with the following command: /sbin/service httpd restart
https://access.redhat.com/errata/RHSA-2002:146
FixedRed Hat Stronghold 3redhat_csaf
We have backported the security fixes for the versions of OpenSSL, mod_ssl and mm included in Stronghold 3. Stronghold 3.0 build code 3018 is now available which includes these fixes, and can be downloaded from http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3.0, see http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:164
FixedRed Hat Linux 7.1redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
https://access.redhat.com/errata/RHSA-2003:106

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–7.8

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.4highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-193USprimary

exploits (1)

Public proof-of-concept and weaponised exploit code.

EDB-21575Apache mod_ssl 2.8.x - Off-by-One HTAccess Buffer Overflowfunctional · exploit_db

affected products (10)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
modssl mod ssl≤ 2.8.9nvdUScpe:2.3:a:modssl:mod_ssl:*:*:*:*:*:*:*:*
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 all versionsfixedredhat_csafUScpe:/o:redhat:enterprise_linux:2.1::as
Red Hat Linux 7.0all versionsfixedredhat_csafUScpe:/o:redhat:linux:7.0
Red Hat Linux 7.1all versionsfixedredhat_csafUScpe:/o:redhat:linux:7.1
Red Hat Linux 7.2all versionsfixedredhat_csafUScpe:/o:redhat:linux:7.2
Red Hat Linux 7.3all versionsfixedredhat_csafUScpe:/o:redhat:linux:7.3
Red Hat Secure Web Server 3.2all versionsfixedredhat_csafUScpe:/a:redhat:secure_web_server:3.2
Red Hat Stronghold 3all versionsfixedredhat_csafUScpe:/a:redhat:stronghold:3
Stronghold 4 for Red Hat Enterprise Linuxall versionsfixedredhat_csafUScpe:/a:redhat:rhel_stronghold:4

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2002:134Red Hat Security Advisory: : Updated mod_ssl packages available2002-07-16csaf · redhat_csafUS
Updated mod_ssl packages are now available for Red Hat Linux 7, 7.1, 7.2, and 7.3. These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.
RHSA-2002:135Red Hat Security Advisory: : : : Updated secureweb packages available2002-07-24csaf · redhat_csafUS
Updated secureweb packages are now available for Red Hat Secure Web Server 3.2 (U.S.). These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.
RHSA-2002:136Red Hat Security Advisory: mod_ssl security update2002-07-16csaf · redhat_csafUS
Updated mod_ssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.
RHSA-2002:146Red Hat Security Advisory: mod_ssl security update for Stronghold2002-08-01csaf · redhat_csafUS
Updated mod_ssl packages are now available for Stronghold on Red Hat Linux Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.
RHSA-2002:164Red Hat Security Advisory: openssl, mm, mod_ssl security update for Stronghold2002-07-31csaf · redhat_csafUS
A new Stronghold 3 release is available which fixes several serious buffer overflow vulnerabilities in OpenSSL, and local privilege escalation vulnerabilities in MM and mod_ssl.
RHSA-2003:106Red Hat Security Advisory: : : : Updated apache and mod_ssl packages available2003-04-22csaf · redhat_csafUS
Updated Apache and mod_ssl packages which fix a number of security issues are now available for iSeries and pSeries systems.

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd nvd redhat_csaf NVD CVE.org MITRE

published 2002-07-11modified 2026-06-16

related (328)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2021-3156US	high7.8OT critical	100.0% (100th)	KEV	2021-01-26
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line arg…
CVE-2003-0466US	critical9.8	78.1% (100th)	Exploit	2003-08-27
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 throug…
CVE-2022-3786US	high7.5	92.5% (100th)	Exploit	2022-11-01
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification…
CVE-2021-23017US	high7.7	53.5% (99th)	Exploit	2021-06-01
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in…
CVE-2001-0609US	critical9.8	18.2% (97th)	Exploit	2001-08-02
Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog f…

+323 more

references (34)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan