CVE-2002-0862: High severity Microsoft Windows 2000 vulnerability

Published Sep 10, 2002

Updated

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.

Affected Software

83 affected components

Microsoft Windows 2000

Microsoft Windows 98

Microsoft Windows 98SE

Microsoft Windows Me

Microsoft Windows NT=4.0

Microsoft Windows XP

All of the following

Any of the following

Microsoft Internet Explorer

Microsoft Office

Microsoft Outlook Express

Apple macOS

Adam Megacz Tinyssl=1.0.2

KDE Konqueror=2.2.2

KDE Konqueror=3.0

KDE Konqueror=3.0.1

KDE Konqueror=3.0.2

Microsoft Ie For Macintosh=5.0

Microsoft Ie For Macintosh=5.1

Microsoft Ie For Macintosh=5.1.1

Microsoft Internet Explorer=5.0

Microsoft Internet Explorer=5.0.1

Microsoft Internet Explorer=5.0.1-sp1

Microsoft Internet Explorer=5.0.1-sp2

Microsoft Internet Explorer=5.5

Microsoft Internet Explorer=5.5-sp1

Microsoft Internet Explorer=5.5-sp2

Microsoft Internet Explorer=6.0

Microsoft Internet Information Services=5.0

Microsoft Office=98

Microsoft Office=2001

Microsoft Office=2001-sr1

Microsoft Office=v.x

Microsoft Outlook Express=4.5

Microsoft Outlook Express=5.0

Microsoft Outlook Express=5.0.1

Microsoft Outlook Express=5.0.2

Microsoft Outlook Express=5.0.3

Baltimore Technologies Mailsecure

KDE kde=2.2.1

KDE kde=2.2.2

KDE kde=3.0

KDE kde=3.0.1

KDE kde=3.0.2

Microsoft Windows 2000

Microsoft Windows 2000=sp1

Microsoft Windows 2000=sp2

Microsoft Windows 2000=sp3

Microsoft Windows 2000 Terminal Services

Microsoft Windows 2000 Terminal Services=sp1

Microsoft Windows 2000 Terminal Services=sp2

Microsoft Windows 2000 Terminal Services=sp3

Microsoft Windows 98=gold

Microsoft Windows 98SE

Microsoft Windows Me

Microsoft Windows NT=4.0

Microsoft Windows NT=4.0-sp1

Microsoft Windows NT=4.0-sp2

Microsoft Windows NT=4.0-sp3

Microsoft Windows NT=4.0-sp4

Microsoft Windows NT=4.0-sp5

Microsoft Windows NT=4.0-sp6

Microsoft Windows NT=4.0-sp6a

Microsoft Windows XP

Microsoft Windows XP=gold

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050

Event History

Sep 10, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0862?

CVE-2002-0862 has a high severity rating as it affects the verification process of certificate chains in various Microsoft products.

How do I fix CVE-2002-0862?

To fix CVE-2002-0862, users should apply the latest security patches provided by Microsoft for their affected software.

What Microsoft products are affected by CVE-2002-0862?

CVE-2002-0862 affects several Microsoft products including Windows 98, Windows 2000, Windows XP, and Microsoft Office applications.

What type of vulnerability is CVE-2002-0862?

CVE-2002-0862 is a certificate validation vulnerability that can allow an attacker to use a forged certificate.

Can CVE-2002-0862 be exploited remotely?

Yes, CVE-2002-0862 can be exploited remotely, making it a critical risk for users running the affected software.