{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Versions du module mod_ssl ant\u00e9rieures \u00e0 la version 2.8.7-1.3.23;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "versions de Apache-ssl ant\u00e9rieures \u00e0 la version 1.3.22-1.47.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nSSL permet l\u0027utilisation de connexions s\u00e9curis\u00e9es sur des serveurs web\n(https://) ou autres serveurs s\u00e9curis\u00e9s (ftps://).\n\nUne vuln\u00e9rabilit\u00e9 de type \u00ab d\u00e9bordement de m\u00e9moire \u00bb \u00e0 \u00e9t\u00e9 d\u00e9couverte\ndans le m\u00e9canisme de gestion de cache de sessions.\n\nCette vuln\u00e9rabilit\u00e9 permet \u00e0 un utilisateur mal intentionn\u00e9 de r\u00e9aliser\nl\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n\n## Contournement provisoire\n\nD\u00e9sactiver le param\u00e8tre -DSSL dans le script httpd en attendant\nd\u0027appliquer les correctifs.\n\n## Solution\n\nInstaller les correctifs disponibles sur\n\n    http://www.apache-ssl.org/\n\net sur\n\n    http://www.modssl.org/\n",
  "cves": [],
  "initial_release_date": "2002-03-05T00:00:00",
  "last_revision_date": "2002-03-05T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 ESA-20020301-005 de EnGarde Secure Linux      /",
      "url": "http://www.engardelinux.org"
    },
    {
      "title": "Message de Ed Moyle sur la liste de diffusion BugTraq",
      "url": "http://online.securityfocus.com/archive/1/258646"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 Apache-SSL",
      "url": "http://www.apache-ssl.org/advisory-20020301.txt"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 2002-0034 de Trustix Secure Linux",
      "url": "http://www.trustix.net/pub/Trustix/updates/"
    }
  ],
  "reference": "CERTA-2002-AVI-049",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-03-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de type \u00ab d\u00e9bordement de m\u00e9moire \u00bb pr\u00e9sente dans le\nmodule mod_ssl et apache-ssl permet \u00e0 un utilisateur mal intentionn\u00e9\nl\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 SSL sous Apache",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Liste de diffusion Bugtraq",
      "url": null
    }
  ]
}