CVE-2002-1407

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-08/0096.htmlExploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=102866120821995&w=2
http://www.securityfocus.com/bid/5410Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/9776
http://archives.neohapsis.com/archives/bugtraq/2002-08/0096.htmlExploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=102866120821995&w=2
http://www.securityfocus.com/bid/5410Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/9776

Timeline

Published: Apr 11, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-14087.5Unknown vulnerability or vulnerabilities in HP OpenView EMANATE 14.2 snmpModules allow the SNMP read-write community name to be exposed, rel CVE-2002-14092.1ptrace on HP-UX 11.00 through 11.11 allows local users to cause a denial of service (data page fault panic) via "an incorrect reference to t CVE-2002-14107.5Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of CVE-2002-14115.0Directory traversal vulnerability in update.dpgs in Duma Photo Gallery System (DPGS) 0.99.4 allows remote attackers to read arbitrary files CVE-2002-14127.5Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR CVE-2002-14137.5RCONAG6 for Novell Netware SP2, while running RconJ in secure mode, allows remote attackers to bypass authentication using the RconJ "Secure CVE-2002-14144.6Buffer overflow in qmailadmin allows local users to gain privileges via a long QMAILADMIN_TEMPLATEDIR environment variable.CVE-2002-14155.0Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service (crash)CVE-2002-14165.0The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authenticati CVE-2002-14175.0Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6 CVE-2002-14185.0Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and CVE-2002-14197.5The upgrade of IRIX on Origin 3000 to 6.5.13 through 6.5.16 changes the MAC address of the system, which could modify intended access restri