Oracle Fusion Middleware Security Service Information Disclosure (January 2015 CPU) (BEAST)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote web server is affected by an information disclosure
vulnerability.

Description :

The version of Oracle HTTP Server installed on the remote host is
affected by an information disclosure vulnerability, known as BEAST,
in the SSL 3.0 and TLS 1.0 protocols due to a flaw in the way the
initialization vector (IV) is selected when operating in cipher-block
chaining (CBC) modes. A man-in-the-middle attacker can exploit this to
obtain plaintext HTTP header data, by using a blockwise
chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with
JavaScript code that uses the HTML5 WebSocket API, the Java
URLConnection API, or the Silverlight WebClient API.

See also :

http://www.nessus.org/u?c02f1515
https://www.imperialviolet.org/2011/09/23/chromeandbeast.html
https://www.openssl.org/~bodo/tls-cbc.txt

Solution :

Apply the appropriate patch according to the January 2015 Oracle
Critical Patch Update advisory.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS Temporal Score : 3.7
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Web Servers

Nessus Plugin ID: 81003 ()

Bugtraq ID: 49778

CVE ID: CVE-2011-3389

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now