CVE-2002-0862

Published Oct 4, 2002

Last updated 9 months ago

Overview

Description: The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-295

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_2000:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "685F1981-EA61-4A00-89F8-A748A88962F8"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_98:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "40FC681A-7B85-4495-8DCC-C459FE7E2F13"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_98se:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2354216-8103-49F9-A95C-7DE4F738BBEE"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_me:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5E44D629-D3EB-4F67-BF67-B25910453562"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_nt:4.0:-:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4C5FEF8F-FB20-4518-A9ED-412B8E924AA2"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_nt:4.0:-:*:*:terminal_server:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E30F6C9C-3371-44FF-AD0B-3CAA0AB6F1B8"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B47EBFCC-1828-45AB-BC6D-FB980929A81A"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C37BA825-679F-4257-9F2B-CE2318B75396"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C6AE930-8EFD-4EE5-AD18-A1205B80DE60"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook_express:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DC52CAA4-467E-402C-BC60-AB322FC5786F"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References