Unscored severity · published Oct 4, 2002
CVE-2002-0862
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98…
–
CVSS
15.8%
EPSS
No
On KEV
Description
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Exploitation
Is it being used?
Exploit prediction (EPSS)15.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Office · Microsoft
All versions, or not specified · source: NVD
IE
Internet Explorer · Microsoft
All versions, or not specified · source: NVD
OE
Outlook Express · Microsoft
All versions, or not specified · source: NVD
W2
Windows 2000 · Microsoft
All versions, or not specified · source: NVD
W9
Windows 98 · Microsoft
All versions, or not specified · source: NVD
W9
Windows 98se · Microsoft
All versions, or not specified · source: NVD
WM
Windows ME · Microsoft
All versions, or not specified · source: NVD
WN
Windows NT · Microsoft
4.0; 4.0 · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0862
Mailing List
http://marc.info/?l=bugtraq&m=102866120821995&w=2
Mailing List
http://marc.info/?l=bugtraq&m=102918200405308&w=2
Mailing List
http://marc.info/?l=bugtraq&m=102976967730450&w=2
Patch
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/9776
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056
More from Office
9.8
CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
9.8
CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
8.8
CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
8.8
CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
8.8
CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability