The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332 | vdb-entry signature x_refsource_OVAL |
| http://marc.info/?l=bugtraq&m=102918200405308&w=2 | mailing-list x_refsource_BUGTRAQ |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056 | vdb-entry signature x_refsource_OVAL |
| http://marc.info/?l=bugtraq&m=102866120821995&w=2 | mailing-list x_refsource_BUGTRAQ |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/9776 | vdb-entry x_refsource_XF |
| http://marc.info/?l=bugtraq&m=102976967730450&w=2 | mailing-list x_refsource_BUGTRAQ |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671 | vdb-entry signature x_refsource_OVAL |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050 | vendor-advisory x_refsource_MS |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332 | vdb-entry signature x_refsource_OVAL x_transferred |
| http://marc.info/?l=bugtraq&m=102918200405308&w=2 | mailing-list x_refsource_BUGTRAQ x_transferred |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056 | vdb-entry signature x_refsource_OVAL x_transferred |
| http://marc.info/?l=bugtraq&m=102866120821995&w=2 | mailing-list x_refsource_BUGTRAQ x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/9776 | vdb-entry x_refsource_XF x_transferred |
| http://marc.info/?l=bugtraq&m=102976967730450&w=2 | mailing-list x_refsource_BUGTRAQ x_transferred |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671 | vdb-entry signature x_refsource_OVAL x_transferred |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050 | vendor-advisory x_refsource_MS x_transferred |
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 6.8 | MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |