NVD

Id
79861  
Name
CVE-2002-0862  
Description
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-07-18  
Published
2002-10-04  
Modified Date
2017-07-10  
Seq
2002-0862  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
398321 79861 CVE-2002-0862 20020805 IE SSL Vulnerability  View
398322 79861 CVE-2002-0862 20020812 IE SSL Exploit  View
398323 79861 CVE-2002-0862 20020819 Insufficient Verification of Client Certificates in IIS 5.0 pre sp3  View
398324 79861 CVE-2002-0862 oval:org.mitre.oval:def:1056  View
398325 79861 CVE-2002-0862 oval:org.mitre.oval:def:1332  View
398326 79861 CVE-2002-0862 oval:org.mitre.oval:def:2671  View
398327 79861 CVE-2002-0862 MS02-050  View
398328 79861 CVE-2002-0862 ssl-ca-certificate-spoofing(9776)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
63885 JVNDB-2002-000212 Microsoft Windows における電子証明書を偽装される脆弱性 Microsoft Windows には、CryptoAPI の実装に不備があり、X.509 証明書の Basic Constraints 領域の確認を十分に行わないため、ルート認証局が信頼できるものであれば、その証明書を信頼してしまう脆弱性が存在します。この脆弱性により、Microsoft Windows が実装する CryptoAPI を使用する全てのアプリケーションが影響を受けます。 CVE-2002-0862 5252 CVE-2002-0862 79861 7.5 http://jvndb.jvn.jp/ja/contents/2002/JVNDB-2002-000212.html 2002-09-04 2007-04-01 View