CVE-2002-0862
- State
- Published
- Severity
- Not scored
- Published
- Sep 10, 2002
- Updated
- Aug 8, 2024
- Reserved
- Aug 15, 2002
Description
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- oval:org.mitre.oval:def:1332vdb-entrysignature
- 20020812 IE SSL Exploitmailing-list
- oval:org.mitre.oval:def:1056vdb-entrysignature
- 20020805 IE SSL Vulnerabilitymailing-list
- ssl-ca-certificate-spoofing(9776)vdb-entry
- 20020819 Insufficient Verification of Client Certificates in IIS 5.0 pre sp3mailing-list
- oval:org.mitre.oval:def:2671vdb-entrysignature
- MS02-050vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.