CVE-2011-3389

MEDIUM

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

References

http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/

http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx

http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx

http://curl.haxx.se/docs/adv_20120124B.html

http://downloads.asterisk.org/pub/security/AST-2016-001.html

http://ekoparty.org/2011/juliano-rizzo.php

http://eprint.iacr.org/2004/111

http://eprint.iacr.org/2006/136

http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html

http://isc.sans.edu/diary/SSL+TLS+part+3+/11635

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html

http://lists.apple.com/archives/security-announce/2012/May/msg00001.html

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html

http://marc.info/?l=bugtraq&m=132750579901589&w=2

http://marc.info/?l=bugtraq&m=132872385320240&w=2

http://marc.info/?l=bugtraq&m=133365109612558&w=2

http://marc.info/?l=bugtraq&m=133728004526190&w=2

http://marc.info/?l=bugtraq&m=134254866602253&w=2

http://marc.info/?l=bugtraq&m=134254957702612&w=2

http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue

http://osvdb.org/74829

http://rhn.redhat.com/errata/RHSA-2012-0508.html

http://rhn.redhat.com/errata/RHSA-2013-1455.html

http://secunia.com/advisories/45791

http://secunia.com/advisories/47998

http://secunia.com/advisories/48256

http://secunia.com/advisories/48692

http://secunia.com/advisories/48915

http://secunia.com/advisories/48948

http://secunia.com/advisories/49198

http://secunia.com/advisories/55322

http://secunia.com/advisories/55350

http://secunia.com/advisories/55351

http://security.gentoo.org/glsa/glsa-201203-02.xml

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://support.apple.com/kb/HT4999

http://support.apple.com/kb/HT5001

http://support.apple.com/kb/HT5130

http://support.apple.com/kb/HT5281

http://support.apple.com/kb/HT5501

http://support.apple.com/kb/HT6150

http://technet.microsoft.com/security/advisory/2588513

http://vnhacker.blogspot.com/2011/09/beast.html

http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf

http://www.debian.org/security/2012/dsa-2398

http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html

http://www.ibm.com/developerworks/java/jdk/alerts/

http://www.imperialviolet.org/2011/09/23/chromeandbeast.html

http://www.insecure.cl/Beast-SSL.rar

http://www.kb.cert.org/vuls/id/864643

http://www.mandriva.com/security/advisories?name=MDVSA-2012:058

http://www.opera.com/docs/changelogs/mac/1151/

http://www.opera.com/docs/changelogs/mac/1160/

http://www.opera.com/docs/changelogs/unix/1151/

http://www.opera.com/docs/changelogs/unix/1160/

http://www.opera.com/docs/changelogs/windows/1151/

http://www.opera.com/docs/changelogs/windows/1160/

http://www.opera.com/support/kb/view/1004/

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html

http://www.redhat.com/support/errata/RHSA-2011-1384.html

http://www.redhat.com/support/errata/RHSA-2012-0006.html

http://www.securityfocus.com/bid/49388

http://www.securityfocus.com/bid/49778

http://www.securitytracker.com/id/1029190

http://www.securitytracker.com/id?1025997

http://www.securitytracker.com/id?1026103

http://www.securitytracker.com/id?1026704

http://www.ubuntu.com/usn/USN-1263-1

http://www.us-cert.gov/cas/techalerts/TA12-010A.html

https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail

https://bugzilla.novell.com/show_bug.cgi?id=719047

https://bugzilla.redhat.com/show_bug.cgi?id=737506

https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862

https://hermes.opensuse.org/messages/13154861

https://hermes.opensuse.org/messages/13155432

https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752

Details

Source: MITRE

Published: 2011-09-06

Updated: 2018-10-12

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:ie:*:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

Tenable Plugins

View all (104 total)

IDNameProductFamilySeverity
133259SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
133172openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
133036SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
720302Siemens SIMATIC RF6XXR < 3.2.1 Multiple Vulnerabilities (ICSA-19-192-04)Nessus Network MonitorSCADA
medium
122590PHP 5.4.x < 5.4.0 Multiple VulnerabilitiesNessusCGI abuses
medium
107926Solaris 10 (x86) : 125359-15 (BEAST)NessusSolaris Local Security Checks
medium
107811Solaris 10 (x86) : 119214-27 (BEAST)NessusSolaris Local Security Checks
medium
107424Solaris 10 (sparc) : 125358-15 (BEAST)NessusSolaris Local Security Checks
medium
107308Solaris 10 (sparc) : 119213-27 (BEAST)NessusSolaris Local Security Checks
medium
89106VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0005) (BEAST) (remote check)NessusMisc.
critical
88715Asterisk Multiple Vulnerabilities (AST-2016-001 - AST-2016-003) (BEAST)NessusMisc.
medium
88584FreeBSD : asterisk -- Multiple vulnerabilities (559f3d1b-cb1d-11e5-80a4-001999f8d30b) (BEAST)NessusFreeBSD Local Security Checks
high
88107Debian DLA-400-1 : pound security update (BEAST) (POODLE)NessusDebian Local Security Checks
medium
82137Debian DLA-154-1 : nss security update (BEAST)NessusDebian Local Security Checks
high
81003Oracle Fusion Middleware Security Service Information Disclosure (January 2015 CPU) (BEAST)NessusWeb Servers
medium
80749Oracle Solaris Third-Party Patch Update : python (multiple_vulnerabilities_in_python) (BEAST)NessusSolaris Local Security Checks
medium
80605Oracle Solaris Third-Party Patch Update : fetchmail (multiple_vulnerabilities_in_fetchmail) (BEAST)NessusSolaris Local Security Checks
medium
79862ESXi 5.1 < Build 2323236 Third-Party Libraries Multiple Vulnerabilities (remote check) (BEAST)NessusMisc.
medium
78975RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)NessusRed Hat Local Security Checks
critical
76303GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)NessusGentoo Local Security Checks
critical
75984openSUSE Security Update : opera (openSUSE-SU-2011:1025-1) (BEAST)NessusSuSE Local Security Checks
medium
75980openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)NessusSuSE Local Security Checks
high
75874openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-5320) (BEAST)NessusSuSE Local Security Checks
critical
75870openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-5329) (BEAST)NessusSuSE Local Security Checks
critical
75806openSUSE Security Update : curl (openSUSE-SU-2012:0229-1) (BEAST)NessusSuSE Local Security Checks
high
75697openSUSE Security Update : opera (openSUSE-SU-2011:1025-1) (BEAST)NessusSuSE Local Security Checks
medium
75685openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)NessusSuSE Local Security Checks
high
75543openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-5320) (BEAST)NessusSuSE Local Security Checks
critical
75539openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-5329) (BEAST)NessusSuSE Local Security Checks
critical
74807openSUSE Security Update : curl (openSUSE-2012-76) (BEAST)NessusSuSE Local Security Checks
high
74640openSUSE Security Update : python (openSUSE-SU-2012:0667-1) (BEAST)NessusSuSE Local Security Checks
medium
74514openSUSE Security Update : mozilla-nss (openSUSE-2011-100) (BEAST)NessusSuSE Local Security Checks
medium
72688Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)NessusMacOS X Local Security Checks
critical
72393Kerio Connect < 8.1.0 SSL/TLS Information Disclosure (BEAST)NessusMisc.
medium
70561Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
high
70460Oracle Database Multiple Vulnerabilities (October 2013 CPU) (BEAST)NessusDatabases
medium
69569Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2011-10) (BEAST)NessusAmazon Linux Local Security Checks
critical
69020HP System Management Homepage < 7.2.1.0 Multiple Vulnerabilities (BEAST)NessusWeb Servers
high
68373Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2011-1380) (BEAST)NessusOracle Linux Local Security Checks
critical
67223SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)NessusSuSE Local Security Checks
medium
66051Mandriva Linux Security Advisory : fetchmail (MDVSA-2013:037)NessusMandriva Local Security Checks
medium
64846Oracle Java SE Multiple Vulnerabilities (October 2011 CPU) (BEAST) (Unix)NessusMisc.
critical
63402GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
critical
6583Mac OS X 10.7 < 10.7.5 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
62214Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
critical
62213Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)NessusMacOS X Local Security Checks
critical
61992Mandriva Linux Security Advisory : fetchmail (MDVSA-2012:149)NessusMandriva Local Security Checks
medium
61956Mandriva Linux Security Advisory : python (MDVSA-2012:097)NessusMandriva Local Security Checks
medium
61725FreeBSD : fetchmail -- chosen plaintext attack against SSL CBC initialization vectors (18ce9a90-f269-11e1-be53-080027ef73ec) (BEAST)NessusFreeBSD Local Security Checks
medium
61413Apple Xcode < 4.4 Multiple Vulnerabilities (Mac OS X) (BEAST)NessusMacOS X Local Security Checks
medium
61158Scientific Linux Security Update : java-1.6.0-sun on SL5.x i386/x86_64 (BEAST)NessusScientific Linux Local Security Checks
critical
61156Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x i386/x86_64 (BEAST)NessusScientific Linux Local Security Checks
critical
59635Mandriva Linux Security Advisory : python (MDVSA-2012:096)NessusMandriva Local Security Checks
medium
59580Fedora 16 : python3-3.2.3-2.fc16 (2012-9135) (BEAST)NessusFedora Local Security Checks
medium
60026Apple iOS < 5.0 Multiple Vulnerabilities (BEAST)NessusMobile Devices
critical
6482Mac OS X 10.7 < 10.7.4 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
59067Mac OS X Multiple Vulnerabilities (Security Update 2012-002) (BEAST)NessusMacOS X Local Security Checks
critical
59066Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
critical
58997Fedora 16 : python-2.7.3-1.fc16 / python-docs-2.7.3-1.fc16 (2012-5924) (BEAST)NessusFedora Local Security Checks
medium
58996Fedora 17 : python3-3.2.3-5.fc17 (2012-5785) (BEAST)NessusFedora Local Security Checks
medium
58979Fedora 15 : python3-3.2.3-1.fc15 (2012-5916) (BEAST)NessusFedora Local Security Checks
medium
58956Fedora 17 : python-2.7.3-3.fc17 / python-docs-2.7.3-1.fc17 (2012-5892) (BEAST)NessusFedora Local Security Checks
medium
58891SuSE 10 Security Update : Python (ZYPP Patch Number 8080) (BEAST)NessusSuSE Local Security Checks
medium
58840RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2012:0508) (BEAST)NessusRed Hat Local Security Checks
critical
58759Mandriva Linux Security Advisory : curl (MDVSA-2012:058)NessusMandriva Local Security Checks
high
58751SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability (BEAST)NessusGeneral
medium
58362VMSA-2012-0005 : VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, Workstation, Player, ESXi, and ESX address several security issuesNessusVMware ESX Local Security Checks
critical
58302VMSA-2012-0003 : VMware VirtualCenter Update and ESX 3.5 patch update JRENessusVMware ESX Local Security Checks
critical
58212GLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
high
58164SuSE 11.1 Security Update : IBM Java 1.6.0 (SAT Patch Number 5872)NessusSuSE Local Security Checks
critical
58113SuSE 11.1 Security Update : IBM Java 1.4.2 (SAT Patch Number 5609)NessusSuSE Local Security Checks
critical
6303Mac OS X 10.7 < 10.7.3 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
57798Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)NessusMacOS X Local Security Checks
critical
57797Mac OS X 10.7.x < 10.7.3 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
critical
57738Debian DSA-2398-2 : curl - several vulnerabilities (BEAST)NessusDebian Local Security Checks
high
57685Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : openjdk-6, openjdk-6b18 regression (USN-1263-2) (BEAST)NessusUbuntu Local Security Checks
critical
57683SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 7908) (BEAST)NessusSuSE Local Security Checks
critical
57658SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7926) (BEAST)NessusSuSE Local Security Checks
critical
57595RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2012:0034) (BEAST)NessusRed Hat Local Security Checks
critical
57508Debian DSA-2368-1 : lighttpd - multiple vulnerabilities (BEAST)NessusDebian Local Security Checks
medium
57499Debian DSA-2358-1 : openjdk-6 - several vulnerabilities (BEAST)NessusDebian Local Security Checks
critical
57474MS12-006: Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584)NessusWindows : Microsoft Bulletins
medium
57464RHEL 5 : java-1.4.2-ibm (RHSA-2012:0006) (BEAST)NessusRed Hat Local Security Checks
critical
57294FreeBSD : opera -- multiple vulnerabilities (a4a809d8-25c8-11e1-b531-00215c6a37bb) (BEAST)NessusFreeBSD Local Security Checks
critical
57226SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)NessusSuSE Local Security Checks
critical
800845Opera < 11.60 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6105Opera < 11.60 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
57039Opera < 11.60 Multiple Vulnerabilities (BEAST)NessusWindows
high
56987Debian DSA-2356-1 : openjdk-6 - several vulnerabilities (BEAST)NessusDebian Local Security Checks
critical
56860Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : icedtea-web, openjdk-6, openjdk-6b18 vulnerabilities (USN-1263-1) (BEAST)NessusUbuntu Local Security Checks
critical
56809Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2011:170)NessusMandriva Local Security Checks
critical
56749Mac OS X : Java for Mac OS X 10.7 Update 1 (BEAST)NessusMacOS X Local Security Checks
critical
56748Mac OS X : Java for Mac OS X 10.6 Update 6 (BEAST)NessusMacOS X Local Security Checks
critical
56724GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
critical
56719Fedora 16 : java-1.6.0-openjdk-1.6.0.0-60.1.10.4.fc16 (2011-15020) (BEAST)NessusFedora Local Security Checks
critical
56566Oracle Java SE Multiple Vulnerabilities (October 2011 CPU) (BEAST)NessusWindows
critical
56560RHEL 4 / 5 / 6 : java-1.6.0-sun (RHSA-2011:1384) (BEAST)NessusRed Hat Local Security Checks
critical
56558CentOS 5 : java-1.6.0-openjdk (CESA-2011:1380) (BEAST)NessusCentOS Local Security Checks
critical
56553RHEL 5 / 6 : java-1.6.0-openjdk (RHSA-2011:1380) (BEAST)NessusRed Hat Local Security Checks
critical
6041Apple iOS < 5.0 Multiple Vulnerabilities Nessus Network MonitorMobile Devices
high
56333DeprecatedNessusWindows
medium
56042Opera < 11.51 Multiple Vulnerabilities (BEAST)NessusWindows
medium
800858Opera < 11.51 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6019Opera < 11.51 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high