CVE-2011-3389 Detail
Modified
This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.
Current Description
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
Source:
MITRE
Description Last Modified:
09/06/2011
View Analysis Description
Analysis Description
Unspecified vulnerability in Opera before 11.51 has unknown attack vectors and a "low severity" impact.
Source:
MITRE
Description Last Modified:
09/06/2011
Impact
CVSS v2.0 Severity and Metrics:
Base Score:
4.3 MEDIUM
Vector:
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
(V2 legend)
Impact Subscore:
2.9
Exploitability Subscore:
8.6
Access Vector (AV):
Network
Access Complexity (AC):
Medium
Authentication (AU):
None
Confidentiality (C):
Partial
Integrity (I):
None
Availability (A):
None
Additional Information:
Allows unauthorized disclosure of information
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because
they may have information that would be of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose.
NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further,
NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about
this page to nvd@nist.gov.
Change History
16 change records found
- show changes
CVE Modified by MITRE -
3/27/2018 9:29:01 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 [No Types Assigned] |
CVE Modified by MITRE -
1/9/2018 9:29:23 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://curl.haxx.se/docs/adv_20120124B.html [No Types Assigned] |
| Added |
Reference |
|
http://www.debian.org/security/2012/dsa-2398 [No Types Assigned] |
CVE Modified by MITRE -
1/5/2018 9:29:18 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://secunia.com/advisories/47998 [No Types Assigned] |
| Added |
Reference |
|
http://www.securitytracker.com/id?1026704 [No Types Assigned] |
CVE Modified by MITRE -
1/4/2018 9:29:10 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://secunia.com/advisories/48256 [No Types Assigned] |
| Added |
Reference |
|
http://security.gentoo.org/glsa/glsa-201203-02.xml [No Types Assigned] |
CVE Modified by MITRE -
12/28/2017 9:29:03 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html [No Types Assigned] |
| Added |
Reference |
|
http://rhn.redhat.com/errata/RHSA-2012-0508.html [No Types Assigned] |
| Added |
Reference |
|
http://www.mandriva.com/security/advisories?name=MDVSA-2012:058 [No Types Assigned] |
CVE Modified by MITRE -
12/21/2017 9:29:05 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://marc.info/?l=bugtraq&m=134254866602253&w=2 [No Types Assigned] |
CVE Modified by MITRE -
9/18/2017 9:33:57 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752 [No Types Assigned] |
| Removed |
Reference |
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14752 [No Types Assigned] |
|
CVE Modified by MITRE -
1/6/2017 9:59:04 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf [No Types Assigned] |
CVE Modified by Source -
8/22/2016 10:04:05 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://marc.info/?l=bugtraq&m=133365109612558&w=2 |
| Added |
Reference |
|
http://marc.info/?l=bugtraq&m=133728004526190&w=2 |
| Added |
Reference |
|
http://marc.info/?l=bugtraq&m=134254957702612&w=2 |
CVE Modified by Source -
6/16/2016 9:59:12 PM
| Action |
Type |
Old Value |
New Value |
| Removed |
Reference |
http://www.securityfocus.com/archive/1/archive/1/535181/100/0/threaded |
|
| Removed |
Reference |
http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html |
|
| Removed |
Reference |
http://seclists.org/fulldisclosure/2015/Apr/5 |
|
CVE Modified by Source -
2/23/2016 9:59:01 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://downloads.asterisk.org/pub/security/AST-2016-001.html |
CVE Translated -
2/17/2016 3:45:07 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Translation |
|
Record truncated, showing 500 of 594 characters.
View Entire Change Record
El protocolo SSL, como se utiliza en ciertas configuraciones en Microsoft Windows y Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera y otros productos, cifra los datos mediante el uso del modo CBC con vectores de inicialización encadenados, lo que permite a atacantes man-in-the-middle obtener cabeceras HTTP en texto plano a través de un ataque blockwise chosen-boundary (BCBA) en una sesión HTTPS, junto con el código de JavaScript que usa (1) la API WebSocket HTML5, (2) la API J |
| Removed |
Translation |
Record truncated, showing 500 of 598 characters.
View Entire Change Record
El protocolo SSL, tal y como se usa en ciertas configuraciones de Microsoft Windows y Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, y otros productos, cifra los datos mediante el uso del modo CBC con vectores de inicialización encadenados, lo que permitiría a atacantes de man-in-the-middle obtener cabeceras HTTP en texto plano a través de un ataque chosen-boundary por bloques (BCBA) en una sesión HTTPS, en conjunto con código JavaScript que utilice (1) HTML5 WebSocket API, |
|
CVE Modified by Source -
7/16/2015 9:59:18 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html |
CVE Modified by Source -
4/14/2015 9:59:24 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html |
| Added |
Reference |
|
http://seclists.org/fulldisclosure/2015/Apr/5 |
| Added |
Reference |
|
http://www.securityfocus.com/archive/1/archive/1/535181/100/0/threaded |
CVE Modified by Source -
1/22/2015 8:59:27 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html |
Initial CVE Analysis -
9/7/2011 8:06:00 AM
Quick Info
CVE Dictionary Entry:
CVE-2011-3389
NVD Published Date:
09/06/2011
NVD Last Modified:
03/27/2018
|