CVE-2011-3389 - Secunia

Blog

Careers

Secunia SmallBusiness

Products

Solutions

Customers

Partner

Resources

Company

Careers

Community

CVE Reference: CVE-2011-3389
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2011-3389

Description: The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVE Status: Candidate

References: SUSE http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html ST 1025997 1026103 SAID Secunia Advisory: SA49198 Secunia Advisory: SA45791 Secunia Advisory: SA48692 Secunia Advisory: SA48915 Secunia Advisory: SA48948 REDHAT http://www.redhat.com/support/errata/RHSA-2012-0006.html http://www.redhat.com/support/errata/RHSA-2011-1384.html OVAL http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14752 OSVDB 74829 MS http://technet.microsoft.com/security/bulletin/MS12-006 MISC http://www.insecure.cl/Beast-SSL.rar http://vnhacker.blogspot.com/2011/09/beast.html http://isc.sans.edu/diary/SSL+TLS+part+3+/11635 http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html http://eprint.iacr.org/2004/111 http://eprint.iacr.org/2006/136 http://ekoparty.org/2011/juliano-rizzo.php HP http://marc.info/?l=bugtraq&m=132872385320240&w=2 http://marc.info/?l=bugtraq&m=132750579901589&w=2 CONFIRM http://support.apple.com/kb/HT5501 http://support.apple.com/kb/HT5281 http://support.apple.com/kb/HT5130 http://www.opera.com/support/kb/view/1004/ http://www.opera.com/docs/changelogs/windows/1160/ http://www.opera.com/docs/changelogs/mac/1160/ http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html http://www.opera.com/docs/changelogs/unix/1160/ http://technet.microsoft.com/security/advisory/2588513 http://www.imperialviolet.org/2011/09/23/chromeandbeast.html http://support.apple.com/kb/HT4999 http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx http://www.ibm.com/developerworks/java/jdk/alerts/ http://support.apple.com/kb/HT5001 http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue http://www.opera.com/docs/changelogs/mac/1151/ http://www.opera.com/docs/changelogs/unix/1151/ http://www.opera.com/docs/changelogs/windows/1151/ http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/ http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx CERT-VN 864643 CERT http://www.us-cert.gov/cas/techalerts/TA12-010A.html BID 49778 49388 APPLE http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html

Return to the previous page.

Products

Solutions

Customers

Partner

Resources

Company

Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)

Industry
Compliance
Technology
Integration

Customers
Testimonials

VARS
MSSP
Technology Partners
References

Factsheets
Reports
Webinars
Events

About us
Careers
Memberships
Newsroom

© 2002-2013 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability