7.5 - MS02-050

Executive Summary

Informations
Name	MS02-050	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Certificate Validation Flaw Could Enable Identity Spoofing (Q329115)

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-295	Certificate Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1056

Oval ID:	oval:org.mitre.oval:def:1056
Title:	Microsoft Certificate Validation Flaw Identity Spoofing Vulnerability
Description:	The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2002-0862	Version:	8
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft CryptoAPI
Definition Synopsis:
the version of crypt32.dll is less than 5.131.2600.1123 AND NOT the patch Q329115 is installed AND NOT the patch kb835732 is installed AND Windows XP (sp1 or earlier) is installed Windows XP is installed AND NOT Win2K/XP/2003 service pack 2 (or later) is installed

Definition Id: oval:org.mitre.oval:def:1059

Oval ID:	oval:org.mitre.oval:def:1059
Title:	Microsoft Certificate Validation Flaw Identity Spoofing Vulnerability (Variant)
Description:	Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2002-1183	Version:	4
Platform(s):	Microsoft Windows NT	Product(s):	Certificate Validation
Definition Synopsis:
Windows NT Server 4.0, Terminal Server Edition is installed Microsoft Windows NT is installed AND this is an NT Terminal Server AND the version of cryptdlg.dll is less then 5.0.1558.6072 AND NOT the patch Q329115 is installed AND NOT the patch kb835732 is installed

Definition Id: oval:org.mitre.oval:def:1332

Oval ID:	oval:org.mitre.oval:def:1332
Title:	Windows 2000 Certificate Validation Identity Spoofing Vulnerability (Test 1)
Description:	The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2002-0862	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Certificate Validation
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND SP4 or later Installed AND the version of cryptdlg.dll is less than 5.0.1558.6608 AND NOT the patch Q329115 is installed AND NOT the patch kb835732 is installed

Definition Id: oval:org.mitre.oval:def:1455

Oval ID:	oval:org.mitre.oval:def:1455
Title:	Windows NT Certificate Validation Identity Spoofing Vulnerability (Test 1)
Description:	Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2002-1183	Version:	4
Platform(s):	Microsoft Windows NT	Product(s):	Certificate Validation
Definition Synopsis:
Windows NT Server 4.0 is installed Microsoft Windows NT is installed AND Windows NT server product option this is an NT Server (stand-alone) AND this is an NT Server (domain controller) AND the version of cryptdlg.dll is less then 5.0.1558.6072 AND NOT the patch Q329115 is installed AND NOT the patch kb835732 is installed

Definition Id: oval:org.mitre.oval:def:2108

Oval ID:	oval:org.mitre.oval:def:2108
Title:	Windows NT Certificate Validation Identity Spoofing Vulnerability (Test 2)
Description:	Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2002-1183	Version:	3
Platform(s):	Microsoft Windows NT	Product(s):	Certificate Validation
Definition Synopsis:
Microsoft Windows NT is installed AND the version of cryptdlg.dll is less then 5.0.1558.6072 AND NOT the patch Q329115 is installed AND NOT the patch kb835732 is installed

Definition Id: oval:org.mitre.oval:def:2671

Oval ID:	oval:org.mitre.oval:def:2671
Title:	Windows 2000 Certificate Validation Identity Spoofing Vulnerability (Test 2)
Description:	The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2002-0862	Version:	6
Platform(s):	Microsoft Windows 2000	Product(s):	Certificate Validation
Definition Synopsis:
Windows 2000 (sp3 or earlier) is installed Windows 2000 is installed AND NOT Win2K/XP/2003 service pack 4 (or later) is installed AND the version of cryptdlg.dll is less then 5.0.1558.6072 AND NOT the patch Q329115 is installed AND NOT the patch kb835732 is installed

CPE : Common Platform Enumeration

Type	Description	Count
Os	Microsoft Windows 2000 cpe:2.3:o:microsoft:windows_2000:-:::::::*	1
Os	Microsoft Windows 98 cpe:2.3:o:microsoft:windows_98::gold::::::* cpe:2.3:o:microsoft:windows_98:-:::::::*	2
Os	Microsoft Windows 98Se cpe:2.3:o:microsoft:windows_98se:::::::: cpe:2.3:o:microsoft:windows_98se:-:::::::*	2
Os	Microsoft Windows Me cpe:2.3:o:microsoft:windows_me:-:::::::*	1
Os	Microsoft Windows Nt cpe:2.3:o:microsoft:windows_nt:4.0:-:::terminal_server:::* cpe:2.3:o:microsoft:windows_nt:4.0:-:::-:::* cpe:2.3:o:microsoft:windows_nt:4.0:::::::*	3
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp:-:::::::*	1

OpenVAS Exploits

Date	Description
2009-03-16	Name : Microsoft MS03-018 security check File : nvt/remote-MS03-018.nasl
2009-03-15	Name : MS04-011 security check File : nvt/remote-MS04-011.nasl
2005-11-03	Name : Certificate Validation Flaw Could Enable Identity Spoofing (Q328145) File : nvt/smb_nt_ms02-050.nasl
2005-11-03	Name : Flaw in Microsoft VM Could Allow Code Execution (810030) File : nvt/smb_nt_ms02-052.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
865	Multiple Vendor SSL Basic Constraints Intermediate CA-signed Certificate Vali...

Nessus® Vulnerability Scanner

Date	Description
2002-10-24	Name : It is possible to spoof user identities. File : smb_nt_ms02-050.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:44:45	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	6
CPE ID(s)	10
osvdb(s)	1
Openvas Exploit(s)	4
Nessus® Exploit(s)	1

	Related
7.5	CVE-2002-1183
6.8	CVE-2002-0862
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0722s

Facebook rss twitter linkedin mail