Description
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Products
- Microsoft Internet Explorer
- Microsoft Office
- Microsoft Office for Android
- Microsoft Office for iPhone OS
- Microsoft Office for Universal
- Microsoft outlook_express
- Microsoft Windows 2000
- Microsoft Windows 2000 Japanese Server Edition
- Microsoft Windows 2000 Advanced Server Edition
- Microsoft Windows 2000 Datacenter Server Edition
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Server Edition
- Microsoft Windows 2000 Beta 3
- Microsoft windows 2000_gold
- Microsoft Windows 2000 Addvanced Server (Initial Release)
- Microsoft Windows 2000 Datacenter Server (Initial Release)
- Microsoft Windows 2000 Professional (Initial release)
- Microsoft Windows 2000 Server (Inital release)
- Microsoft windows 2000_rc1
- Microsoft windows 2000_rc2
- Microsoft windows 2000_sp1
- Microsoft Windows 2000 Service Pack 1 Advanced Server Edition
- Microsoft Windows 2000 Service Pack 1 Datacenter Server Edition
- Microsoft Windows 2000 Service Pack 1 Professional Edition
- Microsoft Windows 2000 Service Pack 1 Server Edition
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Server SP1
- Microsoft windows 2000_sp2
- Microsoft Windows 2000 Service Pack 2 Advanced Server Edition
- Microsoft Windows 2000 Service Pack 2 Datacenter Server Edition
- Microsoft Windows 2000 Service Pack 2 Professional Edition
- Microsoft Windows 2000 Service Pack 2 Server Edition
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Server SP2
- Microsoft windows 2000_sp3
- Microsoft Windows 2000 Service Pack 3 Advanced Server Edition
- Microsoft Windows 2000 Service Pack 3 Datacenter Server Edition
- Microsoft Windows 2000 Service Pack 3 Professional Edition
- Microsoft Windows 2000 Service Pack 3 Server Edition
- Microsoft Windows 2000 Advanced Server SP3
- Microsoft Windows 2000 Datacenter Server SP3
- Microsoft Windows 2000 Professional SP3
- Microsoft Windows 2000 Server SP3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows 2000 Service Pack 4 Advanced Server Edition
- Microsoft Windows 2000 Service Pack 4 Datacenter Server Edition
- Microsoft Windows 2000 Service Pack 4 Professional Edition
- Microsoft Windows 2000 Service Pack 4 Server Edition
- Microsoft Windows 2000 Service Pack 4 French
- Microsoft Windows 2000 Advanced Server SP4
- Microsoft Windows 2000 Datacenter Server SP4
- Microsoft Windows 2000 Professional SP4
- Microsoft Windows 2000 Server SP4
- Microsoft Windows 98
- Microsoft Windows 98 (beta)
- Microsoft windows 98_gold
- Microsoft Windows 98 SCD
- Microsoft windows 98_se
- Microsoft Windows ME
- Microsoft windows me_gold
- Microsoft Windows Millenium Edition SCD
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 Terminal Server
- Microsoft Windows NT 4.0 Terminal Server Edition x64
- Microsoft Windows NT 4.0 Terminal Server Edition x86
- Microsoft Windows XP
- Microsoft Windows XP 64-bit
- Microsoft Windows XP x86 (32-bit)
- Microsoft Windows XP Embedded Edition (XPe) on Itanium
- Microsoft Windows XP Embedded Edition (XPe) on x64
- Microsoft Windows XP Embedded Edition (XPe) on x86
- Microsoft Windows XP Home Edition on Itanium
- Microsoft Windows XP Home Edition on x64
- Microsoft Windows XP Home Edition on x86
- Microsoft Windows XP Media Center Edition on Itanium
- Microsoft Windows XP Media Center Edition on x64
- Microsoft Windows XP Media Center Edition on x86
- Microsoft Windows XP Professional Edition on Itanium
- Microsoft Windows XP Professional Edition on x64
- Microsoft Windows XP Professional Edition on x86
- Microsoft Windows XP Starter Edition on Itanium
- Microsoft Windows XP Starter Edition on x64
- Microsoft Windows XP Starter Edition on x86
- Microsoft Windows XP Tablet PC Edition on Itanium
- Microsoft Windows XP Tablet PC Edition on x64
- Microsoft Windows XP Tablet PC Edition on x86
- Microsoft windows xp_gold
- Microsoft Windows XP Gold Professional Edition
- Microsoft Windows Xp - Gold Professional Edition on X64
- Microsoft Windows XP (gold) 64-Bit Edition for Itanium systems, Version 2002
- Microsoft Windows XP (gold) 64-Bit Edition, Version 2003
- Microsoft windows xp_gold embedded
- Microsoft Windows XP (gold) Home Edition
- Microsoft windows xp_gold media_center
- Microsoft Windows XP Professional Gold
- Microsoft windows xp_gold tablet_pc
- Microsoft Windows XP (gold) x64 (64-bit)
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 1 on x64 (64-bit)
- Microsoft Windows XP Service Pack 1 Embedded Edition (XPe) on Itanium
- Microsoft Windows XP Service Pack 1 Embedded Edition (XPe) on x64
- Microsoft Windows XP Service Pack 1 Embedded Edition (XPe) on x86
- Microsoft Windows XP Service Pack 1 Home Edition
- Microsoft Windows XP Service Pack 1 Home Edition on Itanium
- Microsoft Windows XP Service Pack 1 Home Edition on x64
- Microsoft Windows XP Service Pack 1 Home Edition on x86
- Microsoft Windows XP Service Pack 1 Media Center Edition on Itanium
- Microsoft Windows XP Service Pack 1 Media Center Edition on x64
- Microsoft Windows XP Service Pack 1 Media Center Edition on x86
- Microsoft Windows XP Service Pack 1 Professional Edition on Itanium
- Microsoft Windows XP Service Pack 1 Professional Edition on x64
- Microsoft Windows XP Service Pack 1 Professional Edition on x86
- Microsoft Windows XP Service Pack 1 Starter Edition on Itanium
- Microsoft Windows XP Service Pack 1 Starter Edition on x64
- Microsoft Windows XP Service Pack 1 Starter Edition on x86
- Microsoft Windows XP Service Pack 1 Tablet PC Edition on Itanium
- Microsoft Windows XP Service Pack 1 Tablet PC Edition on x64
- Microsoft Windows XP Service Pack 1 Tablet PC Edition on x86
- Microsoft windows xp_sp1 embedded
- Microsoft Windows XP Service Pack 1 Home Edition
- Microsoft windows xp_sp1 media_center
- Microsoft Windows XP Professional SP1
- Microsoft windows xp_sp1 tablet_pc
- Microsoft Windows XP Service Pack 1 x64 (64-bit)
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP Service Pack 2 Embedded Edition (XPe) on Itanium
- Microsoft Windows XP Service Pack 2 Embedded Edition (XPe) on x64
- Microsoft Windows XP Service Pack 2 Embedded Edition (XPe) on x86
- Microsoft Windows XP Service Pack 2 Home Edition on Itanium
- Microsoft Windows XP Service Pack 2 Home Edition on x64
- Microsoft Windows XP Service Pack 2 Home Edition on x86
- Microsoft Windows XP Service Pack 2 Media Center Edition on Itanium
- Microsoft Windows XP Service Pack 2 Media Center Edition on x64
- Microsoft Windows XP Service Pack 2 Media Center Edition on x86
- Microsoft Windows XP Service Pack 2 Professional Edition
- Microsoft Windows XP Service Pack 2 Professional Edition on Itanium
- Microsoft Windows XP Service Pack 2 Professional Edition on x64
- Microsoft Windows XP Service Pack 2 Professional Edition on x86
- Microsoft Windows XP Service Pack 2 Starter Edition on Itanium
- Microsoft Windows XP Service Pack 2 Starter Edition on x64
- Microsoft Windows XP Service Pack 2 Starter Edition on x86
- Microsoft Windows XP Service Pack 2 Tablet PC Edition on Itanium
- Microsoft Windows XP Service Pack 2 Tablet PC Edition on x64
- Microsoft Windows XP Service Pack 2 Tablet PC Edition on x86
- Microsoft windows xp_sp2 embedded
- Microsoft Windows XP Service Pack 2 Home Edition
- Microsoft windows xp_sp2 media_center
- Microsoft Windows XP Professional SP2
- Microsoft windows xp_sp2 tablet_pc
- Microsoft Windows XP Service Pack 2 x64 (64-bit)
- Microsoft Windows XP x86 (32-bit) Service Pack 2
- Microsoft Windows XP Service Pack 3
- Microsoft Windows XP Service Pack 3 Embedded Edition (XPe) on x64
- Microsoft Windows XP Service Pack 3 Embedded Edition (XPe) on x86
- Microsoft Windows XP Service Pack 3 Home Edition on x64
- Microsoft Windows XP Service Pack 3 Home Edition on x86
- Microsoft Windows XP Service Pack 3 Media Center Edition on x64
- Microsoft Windows XP Service Pack 3 Media Center Edition on x86
- Microsoft Windows XP Service Pack 3 Professional Edition
- Microsoft Windows XP Service Pack 3 Professional Edition on x64
- Microsoft Windows XP Service Pack 3 Professional Edition on x86
- Microsoft Windows XP Service Pack 3 Tablet PC Edition on x64
- Microsoft Windows XP Service Pack 3 Tablet PC Edition on x86
- Microsoft Windows XP Service Pack 3 Embedded Edition
- Microsoft Windows XP Service Pack 3 Home Edition
- Microsoft Windows XP Service Pack 3 Media Center Edition
- Microsoft Windows XP Service Pack 3 Professional Edition
- Microsoft Windows XP Service Pack 3 Tablet PC
- Microsoft Windows XP (x86) Service Pack 3
Questions to Ask Vendors
- Can you confirm whether your systems are affected by CVE-2002-0862, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2002-0862 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions
- Check out the advisory links provided below.
References