CVE-2002-0862
Microsoft Windows and Office - Improper Certificate Validation in CryptoAPI
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2002-0862.
AI-analyzed exploit summary The document describes a vulnerability in X.509 certificate handling, where intermediate certificates lacking the Basic Constraints field are improperly trusted. This allows attackers to spoof domains or perform man-in-the-middle attacks, affecting browsers like Internet Explorer and Konqueror, as well as IIS 5.0.
Description
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Exploits (1)
The document describes a vulnerability in X.509 certificate handling, where intermediate certificates lacking the Basic Constraints field are improperly trusted. This allows attackers to spoof domains or perform man-in-the-middle attacks, affecting browsers like Internet Explorer and Konqueror, as well as IIS 5.0.