CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Published date
2011-09-06T19:55Z
Last modification date
2022-11-29T15:56Z
Assigner
cve@mitre.org
Problem type
CWE-326
NameURLSourceTags
http://www.opera.com/docs/changelogs/unix/1151/http://www.opera.com/docs/changelogs/unix/1151/CONFIRMThird Party Advisory
49388http://www.securityfocus.com/bid/49388BIDThird Party Advisory, VDB Entry
http://www.opera.com/docs/changelogs/windows/1151/http://www.opera.com/docs/changelogs/windows/1151/CONFIRMThird Party Advisory
http://www.opera.com/docs/changelogs/mac/1151/http://www.opera.com/docs/changelogs/mac/1151/CONFIRMThird Party Advisory
74829http://osvdb.org/74829OSVDBBroken Link
45791http://secunia.com/advisories/45791SECUNIANot Applicable
1025997http://www.securitytracker.com/id?1025997SECTRACKBroken Link, Third Party Advisory, VDB Entry
http://eprint.iacr.org/2004/111http://eprint.iacr.org/2004/111MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=737506https://bugzilla.redhat.com/show_bug.cgi?id=737506CONFIRMIssue Tracking, Third Party Advisory
http://ekoparty.org/2011/juliano-rizzo.phphttp://ekoparty.org/2011/juliano-rizzo.phpMISCBroken Link
http://www.imperialviolet.org/2011/09/23/chromeandbeast.htmlhttp://www.imperialviolet.org/2011/09/23/chromeandbeast.htmlCONFIRMThird Party Advisory
https://bugzilla.novell.com/show_bug.cgi?id=719047https://bugzilla.novell.com/show_bug.cgi?id=719047CONFIRMIssue Tracking, Third Party Advisory
http://www.insecure.cl/Beast-SSL.rarhttp://www.insecure.cl/Beast-SSL.rarMISCBroken Link, Patch
http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.htmlhttp://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.htmlMISCBroken Link
http://eprint.iacr.org/2006/136http://eprint.iacr.org/2006/136MISCThird Party Advisory
http://isc.sans.edu/diary/SSL+TLS+part+3+/11635http://isc.sans.edu/diary/SSL+TLS+part+3+/11635MISCThird Party Advisory
http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issuehttp://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issueCONFIRMThird Party Advisory
http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/CONFIRMThird Party Advisory
http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspxhttp://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspxCONFIRMThird Party Advisory
http://technet.microsoft.com/security/advisory/2588513http://technet.microsoft.com/security/advisory/2588513CONFIRMPatch, Vendor Advisory
http://support.apple.com/kb/HT4999http://support.apple.com/kb/HT4999CONFIRMThird Party Advisory
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlhttp://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlCONFIRMThird Party Advisory
http://support.apple.com/kb/HT5001http://support.apple.com/kb/HT5001CONFIRMThird Party Advisory
APPLE-SA-2011-10-12-1http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.htmlAPPLEBroken Link
APPLE-SA-2011-10-12-2http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.htmlAPPLEBroken Link
1026103http://www.securitytracker.com/id?1026103SECTRACKBroken Link, Third Party Advisory, VDB Entry
49778http://www.securityfocus.com/bid/49778BIDThird Party Advisory, VDB Entry
http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspxhttp://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspxCONFIRMThird Party Advisory
RHSA-2011:1384http://www.redhat.com/support/errata/RHSA-2011-1384.htmlREDHATThird Party Advisory, Vendor Advisory
http://vnhacker.blogspot.com/2011/09/beast.htmlhttp://vnhacker.blogspot.com/2011/09/beast.htmlMISCThird Party Advisory
VU#864643http://www.kb.cert.org/vuls/id/864643CERT-VNThird Party Advisory, US Government Resource
http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.htmlhttp://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.htmlCONFIRMNot Applicable, Vendor Advisory
http://www.ibm.com/developerworks/java/jdk/alerts/http://www.ibm.com/developerworks/java/jdk/alerts/CONFIRMThird Party Advisory
http://www.opera.com/docs/changelogs/windows/1160/http://www.opera.com/docs/changelogs/windows/1160/CONFIRMThird Party Advisory
http://www.opera.com/docs/changelogs/mac/1160/http://www.opera.com/docs/changelogs/mac/1160/CONFIRMThird Party Advisory
http://www.opera.com/support/kb/view/1004/http://www.opera.com/support/kb/view/1004/CONFIRMThird Party Advisory, Vendor Advisory
http://www.opera.com/docs/changelogs/unix/1160/http://www.opera.com/docs/changelogs/unix/1160/CONFIRMThird Party Advisory
RHSA-2012:0006http://www.redhat.com/support/errata/RHSA-2012-0006.htmlREDHATThird Party Advisory
http://support.apple.com/kb/HT5130http://support.apple.com/kb/HT5130CONFIRMThird Party Advisory
APPLE-SA-2012-02-01-1http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlAPPLEBroken Link, Mailing List
SSRT100740http://marc.info/?l=bugtraq&m=132872385320240&w=2HPIssue Tracking, Mailing List, Third Party Advisory
http://support.apple.com/kb/HT5281http://support.apple.com/kb/HT5281CONFIRMBroken Link
APPLE-SA-2012-05-09-1http://lists.apple.com/archives/security-announce/2012/May/msg00001.htmlAPPLEBroken Link, Mailing List
APPLE-SA-2012-07-25-2http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.htmlAPPLEBroken Link, Mailing List
http://support.apple.com/kb/HT5501http://support.apple.com/kb/HT5501CONFIRMThird Party Advisory
APPLE-SA-2012-09-19-2http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlAPPLEBroken Link, Mailing List
49198http://secunia.com/advisories/49198SECUNIANot Applicable
SUSE-SU-2012:0122http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.htmlSUSEBroken Link
openSUSE-SU-2012:0063https://hermes.opensuse.org/messages/13155432SUSEBroken Link
openSUSE-SU-2012:0030https://hermes.opensuse.org/messages/13154861SUSEBroken Link
SUSE-SU-2012:0114http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlSUSEBroken Link
HPSBUX02730http://marc.info/?l=bugtraq&m=132750579901589&w=2HPIssue Tracking, Mailing List, Third Party Advisory
48692http://secunia.com/advisories/48692SECUNIANot Applicable
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmailhttps://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmailCONFIRMThird Party Advisory
48948http://secunia.com/advisories/48948SECUNIANot Applicable
48915http://secunia.com/advisories/48915SECUNIANot Applicable
TA12-010Ahttp://www.us-cert.gov/cas/techalerts/TA12-010A.htmlCERTThird Party Advisory, US Government Resource
HPSBMU02900https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862HPBroken Link
55351http://secunia.com/advisories/55351SECUNIANot Applicable
55322http://secunia.com/advisories/55322SECUNIANot Applicable
55350http://secunia.com/advisories/55350SECUNIANot Applicable
1029190http://www.securitytracker.com/id/1029190SECTRACKBroken Link, Third Party Advisory, VDB Entry
RHSA-2013:1455http://rhn.redhat.com/errata/RHSA-2013-1455.htmlREDHATBroken Link
APPLE-SA-2013-10-22-3http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.htmlAPPLEBroken Link, Mailing List
USN-1263-1http://www.ubuntu.com/usn/USN-1263-1UBUNTUThird Party Advisory
http://support.apple.com/kb/HT6150http://support.apple.com/kb/HT6150CONFIRMThird Party Advisory
GLSA-201406-32http://security.gentoo.org/glsa/glsa-201406-32.xmlGENTOOThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlCONFIRMThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlCONFIRMThird Party Advisory
http://downloads.asterisk.org/pub/security/AST-2016-001.htmlhttp://downloads.asterisk.org/pub/security/AST-2016-001.htmlCONFIRMThird Party Advisory
SSRT100867http://marc.info/?l=bugtraq&m=134254957702612&w=2HPIssue Tracking, Mailing List, Third Party Advisory
SSRT100805http://marc.info/?l=bugtraq&m=133365109612558&w=2HPIssue Tracking, Mailing List, Third Party Advisory
HPSBUX02777http://marc.info/?l=bugtraq&m=133728004526190&w=2HPIssue Tracking, Mailing List, Third Party Advisory
http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdfhttp://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdfCONFIRMThird Party Advisory
oval:org.mitre.oval:def:14752https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752OVALThird Party Advisory
HPSBMU02799http://marc.info/?l=bugtraq&m=134254866602253&w=2HPIssue Tracking, Mailing List, Third Party Advisory
MDVSA-2012:058http://www.mandriva.com/security/advisories?name=MDVSA-2012:058MANDRIVABroken Link
RHSA-2012:0508http://rhn.redhat.com/errata/RHSA-2012-0508.htmlREDHATThird Party Advisory
SUSE-SU-2012:0602http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.htmlSUSEBroken Link
GLSA-201203-02http://security.gentoo.org/glsa/glsa-201203-02.xmlGENTOOThird Party Advisory
48256http://secunia.com/advisories/48256SECUNIANot Applicable
1026704http://www.securitytracker.com/id?1026704SECTRACKBroken Link, Third Party Advisory, VDB Entry
47998http://secunia.com/advisories/47998SECUNIANot Applicable
DSA-2398http://www.debian.org/security/2012/dsa-2398DEBIANThird Party Advisory
http://curl.haxx.se/docs/adv_20120124B.htmlhttp://curl.haxx.se/docs/adv_20120124B.htmlCONFIRMThird Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02MISCThird Party Advisory, US Government Resource
MS12-006https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006MSPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdfCONFIRMThird Party Advisory
openSUSE-SU-2020:0086http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlSUSEBroken Link