CVE-2011-3389

 

Published at: - 06-09-2011 09:55

Last modified: - 19-10-2022 06:46

Total changes: - 7

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:P/I:N/A:N

 

Verification logic

 

Reference

• http://www.opera.com/docs/changelogs/unix/1151/
• 49388-
• http://www.opera.com/docs/changelogs/windows/1151/
• http://www.opera.com/docs/changelogs/mac/1151/
• 74829-
• 45791-Vendor Advisory
• 1025997-
• http://eprint.iacr.org/2004/111
• https://bugzilla.redhat.com/show_bug.cgi?id=737506
• http://ekoparty.org/2011/juliano-rizzo.php
• http://www.imperialviolet.org/2011/09/23/chromeandbeast.html
• https://bugzilla.novell.com/show_bug.cgi?id=719047
• http://www.insecure.cl/Beast-SSL.rar
• http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html
• http://eprint.iacr.org/2006/136
• http://isc.sans.edu/diary/SSL+TLS+part+3+/11635
• http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue
• http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/
• http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx
• http://technet.microsoft.com/security/advisory/2588513
• http://support.apple.com/kb/HT4999
• http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
• http://support.apple.com/kb/HT5001
• APPLE-SA-2011-10-12-1-
• APPLE-SA-2011-10-12-2-
• 1026103-
• 49778-
• http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx
• RHSA-2011:1384-Vendor Advisory
• http://vnhacker.blogspot.com/2011/09/beast.html
• VU#864643-US Government Resource
• http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html
• http://www.ibm.com/developerworks/java/jdk/alerts/
• http://www.opera.com/docs/changelogs/windows/1160/
• http://www.opera.com/docs/changelogs/mac/1160/
• http://www.opera.com/support/kb/view/1004/
• http://www.opera.com/docs/changelogs/unix/1160/
• RHSA-2012:0006-
• http://support.apple.com/kb/HT5130
• APPLE-SA-2012-02-01-1-
• SSRT100740-
• http://support.apple.com/kb/HT5281
• APPLE-SA-2012-05-09-1-
• APPLE-SA-2012-07-25-2-
• http://support.apple.com/kb/HT5501
• APPLE-SA-2012-09-19-2-
• 49198-
• SUSE-SU-2012:0122-
• openSUSE-SU-2012:0063-
• openSUSE-SU-2012:0030-
• SUSE-SU-2012:0114-
• HPSBUX02730-
• 48692-
• https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail
• 48948-
• 48915-
• TA12-010A-US Government Resource
• HPSBMU02900-
• 55351-
• 55322-
• 55350-
• 1029190-
• RHSA-2013:1455-
• APPLE-SA-2013-10-22-3-
• USN-1263-1-
• http://support.apple.com/kb/HT6150
• GLSA-201406-32-
• http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
• http://downloads.asterisk.org/pub/security/AST-2016-001.html
• SSRT100867-
• SSRT100805-
• HPSBUX02777-
• http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
• oval:org.mitre.oval:def:14752-
• HPSBMU02799-
• MDVSA-2012:058-
• RHSA-2012:0508-
• SUSE-SU-2012:0602-
• GLSA-201203-02-
• 48256-
• 1026704-
• 47998-
• DSA-2398-
• http://curl.haxx.se/docs/adv_20120124B.html
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
• MS12-006-
• https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf
• openSUSE-SU-2020:0086-

 

Keywords

NVD

 

CVE-2011-3389

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures