CVE-2011-3389

Advisory lineage Upstream: 0 Downstream: 30
Modified
Published: 06 Sept 2011, 19:00
Last modified:06 Aug 2024, 23:29

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
3.83% LOW
4% probability -0.06%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

06 Sept 2011, 19:00
Published
Vulnerability first disclosed
06 Aug 2024, 23:29
Last Modified
Vulnerability information updated

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVSS Metrics

  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 3.83%• Percentile: 88%

Techniques & Countermeasures

  • CWE-326•Inadequate Encryption Strength

    The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected Systems

  • canonical•ubuntu_linux

    10.04 | 10.10 | 11.04 | 11.10

  • debian•debian_linux

    5.0 | 6.0

  • Unknown•Chrome

    na

  • haxx•curl

    ≥ 7.10.6, ≤ 7.23.1

  • Unknown•Internet Explorer

    na

  • Unknown•Windows

    na

  • mozilla•firefox

    na

  • opera•opera_browser

    na

  • redhat•enterprise_linux_desktop

    5.0 | 6.0

  • redhat•enterprise_linux_eus

    6.2

  • redhat•enterprise_linux_server

    5.0 | 6.0

  • redhat•enterprise_linux_server_aus

    6.2

  • redhat•enterprise_linux_workstation

    5.0 | 6.0

  • siemens•simatic_rf615r_firmware

    < 3.2.1

  • siemens•simatic_rf68xr_firmware

    < 3.2.1

References (89)