CVE:CVE-2002-0862
CNNVD:CNNVD-200210-074
Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。
Internet Explorer是一款流行的WEB浏览程序，SSL是加密通信协议。Internet Explorer的SSL实现存在问题，远程攻击者可以利用这个漏洞进行中间人攻击。在通常情况下，WEB站点的管理员通过SSL进行通信加密，要实现加密通信，管理员需要生成证书并由CA证书授权中心签发，该WEB站点的URL会保存在证书的识别名小节中的CN(公用名)字段中。CA会验证管理员是否合法拥有的CN字段中的URL，签发证书并返回证书。假定管理员尝试对www.thoughtcrime.org进行加密，就有如下的证书签发过程：[CERT - Issuer: VeriSign / Subject: VeriSign]-> [CERT - Issuer: VeriSign / Subject: www.thoughtcrime.org]当WEB浏览器接收到这个证书时，必须验证CN字段是否与它刚连接的那个域名匹配，并且是否是由一个了已知的CA证书签名，这种情况下攻击者不可能使用合法的CN名和合法的签名来替代证书，所以不存在中间人攻击。但是有些情况下，为了方便会使用本地授权，因此这种情况下www.thoughtcrime.org会从本地授权中获得如下的证书链结构：[Issuer: VeriSign / Subject: VeriSign]-> [Issuer: VeriSign / Subject: Intermediate CA]   -> [Issuer: Intermediate CA / Subject: www.thoughtcrime.org]当WEB浏览器接收到此信息时，它必须验证分支证书的CN字段是否与它刚连接的那个域名匹配，以及该证书是否是由中间CA所签发，并且中间CA签发的证书是否由已知CA证书签发。最后，WEB浏览器还应该检查所有中间证书是否有合法的CA Basic Constraints，也就是说这些分支证书是否有合法授权进行证书签发。但Internet Explorer存在设计漏洞，没有检查CA Basic Constraints信息，这样，具有任意域一个名合法CA签发证书的攻击者可以生成任意其他域名的合法CA证书。假设攻击者是www.thoughtcrime.org的合法管理者，他可以首先可以生成一合法证书并从VeriSign中请求签名：[CERT - Issuer: VeriSign / Subject: VeriSign]-> [CERT - Issuer: VeriSign / Subject: www.thoughtcrime.org]然后为任意域如(www.amazon.com)生成一证书，并使用自己的证书进行签名：[CERT - Issuer: VeriSign / Subject: VeriSign]-> [CERT - Issuer: VeriSign / Subject: www.thoughtcrime.org]   -> [CERT - Issuer: www.thoughtcrime.org / Subject: www.amazon.com]由于IE不会检查www.thoughtcrime.org的Basic Constraints信息，IE就会按照这个证书链合法接收www.amazon.com域。任何人拥有任何CA签发的证书(和相应的私钥)可以欺骗任何用户。
solution:Upgrade adam_megacz tinyssl to a higher version than 1.0.2,and avoid the version 1.0.2; Upgrade kde konqueror to a higher version than 2.2.2,3.0,3.0.1,3.0.2,and avoid the version 2.2.2,3.0,3.0.1,3.0.2; Upgrade microsoft ie_for_macintosh to a higher version than 5.0,5.1,5.1.1,and avoid the version 5.0,5.1,5.1.1; Upgrade microsoft internet_explorer to a higher version than 5.0,5.0.1,5.0.1:sp1,5.0.1:sp2,5.5,5.5:sp1,5.5:sp2,6.0,and avoid the version 5.0,5.0.1,5.0.1:sp1,5.0.1:sp2,5.5,5.5:sp1,5.5:sp2,6.0; Upgrade microsoft internet_information_services to a higher version than 5.0,and avoid the version 5.0; Upgrade microsoft office to a higher version than 98,2001,2001:sr1,v.x,and avoid the version 98,2001,2001:sr1,v.x; Upgrade microsoft outlook_express to a higher version than 4.5,5.0,5.0.1,5.0.2,5.0.3,and avoid the version 4.5,5.0,5.0.1,5.0.2,5.0.3; Upgrade baltimore_technologies mailsecure to a higher version than *; Upgrade kde kde to a higher version than 2.2.1,2.2.2,3.0,3.0.1,3.0.2,and avoid the version 2.2.1,2.2.2,3.0,3.0.1,3.0.2; Upgrade microsoft windows_2000 to a higher version than *,*:sp1,*:sp2,*:sp3,and avoid the version *:sp1,*:sp2,*:sp3; Upgrade microsoft windows_2000_terminal_services to a higher version than *,*:sp1,*:sp2,*:sp3,and avoid the version *:sp1,*:sp2,*:sp3; Upgrade microsoft windows_98 to a higher version than *:gold,and avoid the version *:gold; Upgrade microsoft windows_98se to a higher version than *; Upgrade microsoft windows_me to a higher version than *; Upgrade microsoft windows_nt to a higher version than 4.0,4.0:sp1,4.0:sp2,4.0:sp3,4.0:sp4,4.0:sp5,4.0:sp6,4.0:sp6a,and avoid the version 4.0,4.0:sp1,4.0:sp2,4.0:sp3,4.0:sp4,4.0:sp5,4.0:sp6,4.0:sp6a; Upgrade microsoft windows_xp to a higher version than *,*:gold,and avoid the version *:gold