CVE-2011-3389

EUVD-2011-3352

06.09.2011, 19:55

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:N/C:P/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Affected Products (NVD)

Vendor	Product	Version
google	chrome	-
microsoft	internet_explorer	-
mozilla	firefox	-
opera	opera_browser	-
microsoft	windows	-
siemens	simatic_rf68xr_firmware	𝑥 < 3.2.1
siemens	simatic_rf615r_firmware	𝑥 < 3.2.1
haxx	curl	7.10.6 ≤ 𝑥 ≤ 7.23.1
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	6.2
redhat	enterprise_linux_server	5.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	6.2
redhat	enterprise_linux_workstation	5.0
redhat	enterprise_linux_workstation	6.0
debian	debian_linux	5.0
debian	debian_linux	6.0
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	10.10
canonical	ubuntu_linux	11.04
canonical	ubuntu_linux	11.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

asterisk

bullseye	1:16.28.0~dfsg-0+deb11u4 fixed
bullseye (security)	1:16.28.0~dfsg-0+deb11u5 fixed
lenny	no-dsa
sid	1:22.0.0~dfsg+~cs6.14.60671435-1 fixed
squeeze	no-dsa
wheezy	no-dsa

bouncycastle

bookworm	1.72-2 fixed
bullseye	1.68-2 fixed
lenny	no-dsa
sid	1.77-1 fixed
squeeze	no-dsa
trixie	1.77-1 fixed
wheezy	no-dsa

curl

bookworm	7.88.1-10+deb12u7 fixed
bookworm (security)	7.88.1-10+deb12u5 fixed
bullseye	7.74.0-1.3+deb11u13 fixed
bullseye (security)	7.74.0-1.3+deb11u11 fixed
lenny	no-dsa
sid	8.10.1-2 fixed
squeeze	no-dsa
trixie	8.10.1-2 fixed
wheezy	no-dsa

erlang

bookworm	1:25.2.3+dfsg-1 fixed
bullseye	1:23.2.6+dfsg-1+deb11u1 fixed
lenny	no-dsa
sid	1:25.3.2.12+dfsg-3 fixed
squeeze	no-dsa
trixie	1:25.3.2.12+dfsg-3 fixed
wheezy	no-dsa

gnutls28

bookworm	unimportant
bullseye	unimportant
bullseye (security)	unimportant
lenny	no-dsa
sid	unimportant
squeeze	no-dsa
trixie	unimportant
wheezy	no-dsa

haskell-tls

bookworm	unimportant
bullseye	unimportant
lenny	no-dsa
sid	unimportant
squeeze	no-dsa
trixie	unimportant
wheezy	no-dsa

lighttpd

bookworm	1.4.69-1 fixed
bullseye	1.4.59-1+deb11u2 fixed
bullseye (security)	1.4.59-1+deb11u2 fixed
lenny	no-dsa
sid	1.4.76-1 fixed
squeeze	no-dsa
trixie	1.4.76-1 fixed
wheezy	no-dsa

nss

bookworm	2:3.87.1-1 fixed
bullseye	2:3.61-1+deb11u3 fixed
bullseye (security)	2:3.61-1+deb11u4 fixed
lenny	no-dsa
sid	2:3.105-2 fixed
squeeze	no-dsa
trixie	2:3.105-2 fixed
wheezy	no-dsa

pound

bullseye	3.0-2 fixed
lenny	no-dsa
sid	4.14-2 fixed
squeeze	no-dsa
trixie	4.14-2 fixed
wheezy	no-dsa

python2.7

bullseye	2.7.18-8+deb11u1 fixed
lenny	no-dsa
squeeze	no-dsa
wheezy	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

gnutls26

hardy	dne
lucid	not-affected
maverick	not-affected
natty	not-affected
oneiric	not-affected
precise	not-affected
quantal	not-affected

icedtea-web

hardy	dne
lucid	not-affected
maverick	dne
natty	not-affected
oneiric	not-affected
precise	not-affected
quantal	not-affected

lighttpd

hardy	ignored
lucid	ignored
maverick	ignored
natty	ignored
oneiric	ignored
precise	ignored
quantal	ignored

openjdk-6

hardy	Fixed 6b27-1.12.3-0ubuntu1~08.04.1 released
lucid	Fixed 6b20-1.9.10-0ubuntu1~10.04.2 released
maverick	Fixed 6b20-1.9.10-0ubuntu1~10.10.2 released
natty	Fixed 6b22-1.10.4-0ubuntu1~11.04.1 released
oneiric	Fixed 6b23~pre11-0ubuntu1.11.10 released
precise	not-affected
quantal	not-affected

openjdk-6b18

hardy	dne
lucid	Fixed 6b18-1.8.10-0ubuntu1~10.04.2 released
maverick	Fixed 6b18-1.8.10-0ubuntu1~10.10.2 released
natty	Fixed 6b18-1.8.10-0ubuntu1~11.04.1 released
oneiric	ignored
precise	dne
quantal	dne

openjdk-7

hardy	dne
lucid	dne
maverick	dne
natty	dne
oneiric	Fixed 7~b147-2.0-0ubuntu0.11.10.1 released
precise	Fixed 7~b147-2.0-1ubuntu1 released
quantal	Fixed 7~b147-2.0-1ubuntu1 released