CVEvulnerability

CVE-2011-3389

4.3 MEDIUM Published 2011-09-06 Modified 2026-10-09 Official page ↗

Status: Modified
Published: 2011-09-06
Last modified: 2026-10-09
Assigner: [email protected]
CVSS 2.0 ([email protected]): 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses: CWE-326

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Affected configurations

• google chrome • microsoft internet explorer • mozilla firefox • opera opera browser • microsoft windows • siemens simatic rf68xr firmware (< 3.2.1) • siemens simatic rf615r firmware (< 3.2.1) • haxx curl (>= 7.10.6 <= 7.23.1) • redhat enterprise linux desktop 5.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux eus 6.2 • redhat enterprise linux server 5.0 • redhat enterprise linux server 6.0 • redhat enterprise linux server aus 6.2 • redhat enterprise linux workstation 5.0 • redhat enterprise linux workstation 6.0 • debian debian linux 5.0 • debian debian linux 6.0 • canonical ubuntu linux 10.04 • canonical ubuntu linux 10.10 • canonical ubuntu linux 11.04 • canonical ubuntu linux 11.10

Weakness · CWE (1)

CWE-326 Inadequate Encryption Strength weakness

Referenced by CWE · observed example (2)

CWE-1204 Generation of Weak Initialization Vector (IV) weakness
CWE-329 Generation of Predictable IV with CBC Mode weakness

References

http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/ Third Party Advisory
http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx Third Party Advisory
http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx Third Party Advisory
http://curl.haxx.se/docs/adv_20120124B.html Third Party Advisory
http://downloads.asterisk.org/pub/security/AST-2016-001.html Third Party Advisory
http://ekoparty.org/2011/juliano-rizzo.php Broken Link
http://eprint.iacr.org/2004/111 Third Party Advisory
http://eprint.iacr.org/2006/136 Third Party Advisory
http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html Not Applicable, Vendor Advisory
http://isc.sans.edu/diary/SSL+TLS+part+3+/11635 Third Party Advisory
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html Broken Link
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html Broken Link
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html Broken Link, Mailing List
http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html Broken Link, Mailing List
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html Broken Link, Mailing List
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html Broken Link, Mailing List
http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html Broken Link, Mailing List
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Broken Link
http://marc.info/?l=bugtraq&m=132750579901589&w=2 Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=132872385320240&w=2 Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133365109612558&w=2 Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133728004526190&w=2 Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=134254866602253&w=2 Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=134254957702612&w=2 Issue Tracking, Mailing List, Third Party Advisory
http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue Third Party Advisory
http://osvdb.org/74829 Broken Link
http://rhn.redhat.com/errata/RHSA-2012-0508.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1455.html Broken Link
http://secunia.com/advisories/45791 Not Applicable
http://secunia.com/advisories/47998 Not Applicable
http://secunia.com/advisories/48256 Not Applicable
http://secunia.com/advisories/48692 Not Applicable
http://secunia.com/advisories/48915 Not Applicable
http://secunia.com/advisories/48948 Not Applicable
http://secunia.com/advisories/49198 Not Applicable
http://secunia.com/advisories/55322 Not Applicable
http://secunia.com/advisories/55350 Not Applicable
http://secunia.com/advisories/55351 Not Applicable
http://security.gentoo.org/glsa/glsa-201203-02.xml Third Party Advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory
http://support.apple.com/kb/HT4999 Third Party Advisory
http://support.apple.com/kb/HT5001 Third Party Advisory
http://support.apple.com/kb/HT5130 Third Party Advisory
http://support.apple.com/kb/HT5281 Broken Link
http://support.apple.com/kb/HT5501 Third Party Advisory
http://support.apple.com/kb/HT6150 Third Party Advisory
http://technet.microsoft.com/security/advisory/2588513 Patch, Vendor Advisory
http://vnhacker.blogspot.com/2011/09/beast.html Third Party Advisory
http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf Third Party Advisory
http://www.debian.org/security/2012/dsa-2398 Third Party Advisory
http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html Broken Link
http://www.ibm.com/developerworks/java/jdk/alerts/ Third Party Advisory
http://www.imperialviolet.org/2011/09/23/chromeandbeast.html Third Party Advisory
http://www.insecure.cl/Beast-SSL.rar Broken Link, Patch
http://www.kb.cert.org/vuls/id/864643 Third Party Advisory, US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2012:058 Broken Link
http://www.opera.com/docs/changelogs/mac/1151/ Third Party Advisory
http://www.opera.com/docs/changelogs/mac/1160/ Third Party Advisory
http://www.opera.com/docs/changelogs/unix/1151/ Third Party Advisory
http://www.opera.com/docs/changelogs/unix/1160/ Third Party Advisory
http://www.opera.com/docs/changelogs/windows/1151/ Third Party Advisory
http://www.opera.com/docs/changelogs/windows/1160/ Third Party Advisory
http://www.opera.com/support/kb/view/1004/ Third Party Advisory, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-1384.html Third Party Advisory, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2012-0006.html Third Party Advisory
http://www.securityfocus.com/bid/49388 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/49778 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029190 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1025997 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1026103 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1026704 Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1263-1 Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA12-010A.html Third Party Advisory, US Government Resource
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail Third Party Advisory