NetSight
IP …
medium6.8Public exploit code

CVE-2002-0862

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Micros…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.

Affected products

VendorProductAffected versions
MicrosoftWindows 2000
All versions
MicrosoftWindows 98
All versions
MicrosoftWindows 98se
All versions
MicrosoftWindows Me
All versions
MicrosoftWindows Nt
Version 4.0
MicrosoftWindows Xp
All versions
MicrosoftInternet Explorer
All versions
MicrosoftOffice
All versions
MicrosoftOutlook Express
All versions

Weakness classification

CWE-295

References