CVE-2002-0862

{"id": "CVE-2002-0862", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2002-10-04T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=102866120821995&w=2", "tags": ["Mailing List"], "source": "[email protected]"}, {"url": "http://marc.info/?l=bugtraq&m=102918200405308&w=2", "tags": ["Mailing List"], "source": "[email protected]"}, {"url": "http://marc.info/?l=bugtraq&m=102976967730450&w=2", "tags": ["Mailing List"], "source": "[email protected]"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050", "tags": ["Patch", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9776", "tags": ["Third Party Advisory", "VDB Entry"], "source": "[email protected]"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "http://marc.info/?l=bugtraq&m=102866120821995&w=2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://marc.info/?l=bugtraq&m=102918200405308&w=2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://marc.info/?l=bugtraq&m=102976967730450&w=2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9776", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS."}, {"lang": "es", "value": "Las APIs (Application Programming Interface) \r\n\r\nCertGetCertificateChain\r\nCertVerifyCertificateChainPolicy \r\nWinVerifyTrust\r\n\r\nen la CriptoAPI de productos de Microsoft, incluyendo Microsoft Windows 98 a XP, Office para Mac, Internet Explorer para Mac, y Outlook Express para Mac, no verifican adecuadamente las restricciones b\u00e1sicas de certificados X.509 firmados por CAs (Autoridad Certificadora) intermedias, lo que permite a atacantes remotos falsear los certificados de sitios de confianza mediante un ataque tipo hombre-en-el-medio en sesiones SSL, como se inform\u00f3 anteriormente para Internet Explorer e IIS."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2000:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "685F1981-EA61-4A00-89F8-A748A88962F8"}, {"criteria": "cpe:2.3:o:microsoft:windows_98:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40FC681A-7B85-4495-8DCC-C459FE7E2F13"}, {"criteria": "cpe:2.3:o:microsoft:windows_98se:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2354216-8103-49F9-A95C-7DE4F738BBEE"}, {"criteria": "cpe:2.3:o:microsoft:windows_me:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E44D629-D3EB-4F67-BF67-B25910453562"}, {"criteria": "cpe:2.3:o:microsoft:windows_nt:4.0:-:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "4C5FEF8F-FB20-4518-A9ED-412B8E924AA2"}, {"criteria": "cpe:2.3:o:microsoft:windows_nt:4.0:-:*:*:terminal_server:*:*:*", "vulnerable": true, "matchCriteriaId": "E30F6C9C-3371-44FF-AD0B-3CAA0AB6F1B8"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B47EBFCC-1828-45AB-BC6D-FB980929A81A"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C37BA825-679F-4257-9F2B-CE2318B75396"}, {"criteria": "cpe:2.3:a:microsoft:office:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C6AE930-8EFD-4EE5-AD18-A1205B80DE60"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC52CAA4-467E-402C-BC60-AB322FC5786F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}