CVE-2002-0862
First published: Tue Sep 10 2002(Updated: )
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Outlook Express | =5.0 | |
| KDE Konqueror | =3.0.2 | |
| Microsoft Ie For Macintosh | =5.1 | |
| Microsoft Office | =2001-sr1 | |
| Microsoft Internet Information Services | =5.0 | |
| KDE Konqueror | =2.2.2 | |
| KDE Konqueror | =3.0 | |
| Microsoft Outlook Express | =5.0 | |
| KDE Konqueror | =3.0.1 | |
| Adam Megacz Tinyssl | =1.0.2 | |
| Microsoft Outlook Express | =5.0.2 | |
| Microsoft Office | =2001 | |
| Microsoft Office | =98 | |
| Microsoft Ie For Macintosh | =5.1.1 | |
| Microsoft Office | =v.x | |
| Microsoft Outlook Express | =4.5 | |
| Microsoft Outlook Express | =5.0.3 | |
| Microsoft Outlook Express | =5.0.1 | |
| Microsoft Ie For Macintosh | =5.0 | |
| Microsoft Internet Explorer | =5.5-sp2 | |
| Microsoft Internet Explorer | =5.0 | |
| Microsoft Internet Explorer | =5.0.1 | |
| Microsoft Internet Explorer | =5.0.1-sp2 | |
| Microsoft Internet Explorer | =5.0.1-sp1 | |
| Microsoft Internet Explorer | =5.5 | |
| Microsoft Internet Explorer | =5.5-sp1 | |
| Microsoft Internet Explorer | =6.0 | |
| KDE KDE | =2.2.1 | |
| Microsoft Windows NT | =4.0 | |
| Microsoft Windows NT | =4.0-sp4 | |
| Microsoft Windows 2000 Terminal Services | =sp1 | |
| KDE KDE | =3.0.2 | |
| Baltimore Technologies Mailsecure | ||
| Microsoft Windows NT | =4.0-sp2 | |
| Microsoft Windows NT | =4.0 | |
| Microsoft Windows NT | =4.0-sp5 | |
| Microsoft Windows XP | =gold | |
| Microsoft Windows 2000 | ||
| Microsoft Windows NT | =4.0-sp6 | |
| Microsoft Windows XP | ||
| Microsoft Windows NT | =4.0-sp6 | |
| KDE KDE | =3.0.1 | |
| Microsoft Windows NT | =4.0-sp6a | |
| Microsoft Windows NT | =4.0-sp1 | |
| Microsoft Windows 98SE | ||
| Microsoft Windows NT | =4.0-sp2 | |
| Microsoft Windows 2000 | =sp2 | |
| Microsoft Windows NT | =4.0-sp1 | |
| Microsoft Windows NT | =4.0-sp4 | |
| Microsoft Windows NT | =4.0-sp3 | |
| Microsoft Windows NT | =4.0-sp4 | |
| Microsoft Windows 2000 Terminal Services | =sp3 | |
| Microsoft Windows NT | =4.0-sp6a | |
| KDE KDE | =3.0 | |
| Microsoft Windows NT | =4.0 | |
| Microsoft Windows NT | =4.0-sp6a | |
| Microsoft Windows NT | =4.0-sp6 | |
| Microsoft Windows NT | =4.0-sp1 | |
| Microsoft Windows 2000 | =sp1 | |
| Microsoft Windows XP | ||
| KDE KDE | =2.2.2 | |
| Microsoft Windows Me | ||
| Microsoft Windows NT | =4.0-sp2 | |
| Microsoft Windows NT | =4.0-sp5 | |
| Microsoft Windows NT | =4.0-sp3 | |
| Microsoft Windows 2000 Terminal Services | ||
| Microsoft Windows NT | =4.0-sp3 | |
| Microsoft Windows NT | =4.0-sp5 | |
| Microsoft Windows 98 | =gold | |
| Microsoft Windows 2000 Terminal Services | =sp2 | |
| Microsoft Windows XP | =gold | |
| Microsoft Windows 2000 | =sp3 | |
| Microsoft Windows 2000 | ||
| Microsoft Windows 98 | ||
| Microsoft Windows 98SE | ||
| Microsoft Windows Me | ||
| Microsoft Windows NT | =4.0 | |
| Microsoft Windows NT | =4.0 | |
| Microsoft Windows XP | ||
| All of | ||
| Any of | ||
| Microsoft Internet Explorer | ||
| Microsoft Office | ||
| Microsoft Outlook Express | ||
| Apple macOS |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://marc.info/?l=bugtraq&m=102976967730450&w=2
- http://marc.info/?l=bugtraq&m=102866120821995&w=2
- http://marc.info/?l=bugtraq&m=102918200405308&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/9776
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/softwarecombine
- agent/event
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft outlook express
- version/microsoft outlook express/5.0
- vendor/kde
- canonical/kde konqueror
- version/kde konqueror/3.0.2
- canonical/microsoft ie for macintosh
- version/microsoft ie for macintosh/5.1
- canonical/microsoft office
- version/microsoft office/2001-sr1
- canonical/microsoft internet information services
- version/microsoft internet information services/5.0
- version/kde konqueror/2.2.2
- version/kde konqueror/3.0
- version/kde konqueror/3.0.1
- vendor/adam megacz
- canonical/adam megacz tinyssl
- version/adam megacz tinyssl/1.0.2
- version/microsoft outlook express/5.0.2
- version/microsoft office/2001
- version/microsoft office/98
- version/microsoft ie for macintosh/5.1.1
- version/microsoft office/v.x
- version/microsoft outlook express/4.5
- version/microsoft outlook express/5.0.3
- version/microsoft outlook express/5.0.1
- version/microsoft ie for macintosh/5.0
- canonical/microsoft internet explorer
- version/microsoft internet explorer/5.5-sp2
- version/microsoft internet explorer/5.0
- version/microsoft internet explorer/5.0.1
- version/microsoft internet explorer/5.0.1-sp2
- version/microsoft internet explorer/5.0.1-sp1
- version/microsoft internet explorer/5.5
- version/microsoft internet explorer/5.5-sp1
- version/microsoft internet explorer/6.0
- canonical/kde kde
- version/kde kde/2.2.1
- canonical/microsoft windows nt
- version/microsoft windows nt/4.0
- version/microsoft windows nt/4.0-sp4
- canonical/microsoft windows 2000 terminal services
- version/microsoft windows 2000 terminal services/sp1
- version/kde kde/3.0.2
- vendor/baltimore technologies
- canonical/baltimore technologies mailsecure
- version/microsoft windows nt/4.0-sp2
- version/microsoft windows nt/4.0-sp5
- canonical/microsoft windows xp
- version/microsoft windows xp/gold
- canonical/microsoft windows 2000
- version/microsoft windows nt/4.0-sp6
- version/kde kde/3.0.1
- version/microsoft windows nt/4.0-sp6a
- version/microsoft windows nt/4.0-sp1
- canonical/microsoft windows 98se
- version/microsoft windows 2000/sp2
- version/microsoft windows nt/4.0-sp3
- version/microsoft windows 2000 terminal services/sp3
- version/kde kde/3.0
- version/microsoft windows 2000/sp1
- version/kde kde/2.2.2
- canonical/microsoft windows me
- canonical/microsoft windows 98
- version/microsoft windows 98/gold
- version/microsoft windows 2000 terminal services/sp2
- version/microsoft windows 2000/sp3
- vendor/apple
- canonical/apple macos