CVE-2002-1183

Vulnerability

Microsoft Windows 98, Windows 98 Second Edition, and Windows NT 4.0 (including Terminal Server Edition) do not properly verify the Basic Constraints extension of digital certificates [1]. This flaw allows a certificate that is not a Certificate Authority (CA) certificate to be treated as a CA certificate, enabling identity spoofing. The vulnerability is present in the certificate validation logic of the affected operating systems.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious digital certificate that appears to be issued by a trusted CA. The attacker then hosts a website or sends an email containing an Authenticode-signed executable that uses this spoofed certificate. If a user visits the website or opens the attachment, the attacker can execute arbitrary code on the user's system. No authentication is required, but user interaction is necessary.

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the logged-on user. The attacker could install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability also enables identity spoofing, as the attacker can present a certificate that appears to be from a trusted source.

Mitigation

Microsoft released security bulletin MS02-050 with patches for the affected systems [1]. For Windows 98 and Windows 98 Second Edition, the patch is available as part of the update. For Windows NT 4.0 and Windows NT 4.0 Terminal Server Edition, the patch is also provided. Users should apply the appropriate patch immediately. No workarounds are documented in the bulletin.