CVE-2002-0656: OpenSSL SSL2/SSL3 buffer overflows allow remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution in a core cryptographic library with very high EPSS, though no KEV listing or documented exploit tags in the record.

What it is

OpenSSL 0.9.6d and earlier and 0.9.7-beta2 and earlier contain buffer overflows reachable through SSL2 client master key and SSL3 session ID handling. A remote attacker can trigger the overflow and potentially execute arbitrary code in the context of the affected service. The flaw affects a widely deployed cryptographic library and its downstream products.

Impact

An attacker gains the ability to execute arbitrary code on the vulnerable host, or at minimum crash the SSL service, depending on the overflow's controllability. This can lead to full compromise of the process handling TLS/SSL connections.

Attack surface

The flaw is network-reachable (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L), triggered by malformed SSL2 or SSL3 handshake data sent to a listening service. No user interaction is indicated by the vector or description.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.8982, 99.78th percentile), indicating substantial predicted exploitation activity. Reference tags are limited to US Government Resource advisories with no explicit exploit or weaponization tags.

What to do

• Upgrade OpenSSL to a version later than 0.9.6d / 0.9.7-beta2, or apply the vendor patch for your distribution.
• Disable SSL2 and SSL3 where possible and require TLS 1.0 or later to remove the vulnerable handshake paths.
• Update downstream products listed (Oracle Application Server, HTTP Server, Apple Mac OS X, Corporate Time Outlook Connector) to their patched releases.
• Restrict network exposure of SSL/TLS services to trusted clients until patching is complete.

Detection

• Monitor for crashes or abnormal termination of SSL/TLS services that could indicate malformed handshake attempts.
• Inspect network traffic for oversized SSL2 client master key or SSL3 session ID fields in handshake records.
• Correlate IDS/IPS alerts for OpenSSL handshake anomalies with host logs on systems running unpatched OpenSSL.
• Audit installed OpenSSL versions across hosts to identify systems still on 0.9.6d/0.9.7-beta2 or earlier.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.