Vulnerability in Apple Macos
CVE-2002-0862
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Vulnerability class: Improper Certificate Validation
EPSS: 0.158 (96.5th percentile) — read the EPSS interpretation.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Broken Link, x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List)
- cve@mitre.org (Broken Link, x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List)
- cve@mitre.org (Broken Link, x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (x_refsource_MS, vendor-advisory, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2002-0862?
- CVE-2002-0862 is a vulnerability in Apple Macos, classified under Improper Certificate Validation. Published 2002-10-04.
- Is CVE-2002-0862 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.