Title: Microsoft IE SSL Certificates Vulnerability
Severity: MODERATE
Description:
It is possible for a malicious website to establish an SSL connection to an Internet Explorer client with a forged certificate representing itself to be from a trusted site. Due to a flaw in the implementation of SSL certificate checks within Internet Explorer, not all contents of the certificate are verified when the connection is established from within an IFRAME. Once an SSL connection has been successfully established with a server, new SSL sessions with that server within the same browsing session are established without any certificate verification .
Affected Products:
- Microsoft Internet Explorer 4.0.0
- Microsoft Internet Explorer 4.0.0 for Windows 95
- Microsoft Internet Explorer 4.0.0 for Windows NT 3.51
- Microsoft Internet Explorer 4.0.0 for Windows NT 4.0
- Microsoft Internet Explorer 4.0.1
- Microsoft Internet Explorer 4.0.1 for Windows 98
- Microsoft Internet Explorer 4.0.1 for Windows NT 4.0
- Microsoft Internet Explorer 5.0 for Windows 2000
- Microsoft Internet Explorer 5.0 for Windows 95
- Microsoft Internet Explorer 5.0 for Windows 98
- Microsoft Internet Explorer 5.0 for Windows NT 4.0
- Microsoft Internet Explorer 5.0.1 for Windows 2000
- Microsoft Internet Explorer 5.0.1 for Windows 95
- Microsoft Internet Explorer 5.0.1 for Windows 98
- Microsoft Internet Explorer 5.0.1 for Windows NT 4.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Terminal Services
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
References:
- Microsoft: Frequently Asked Questions: Microsoft Security Bulletin (MS00-039)
- Microsoft: Q254902: Invalid SSL Certificates May Be Bypassed in Internet Explorer
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
