CVE-2011-3389

Scores

EPSS

0.046very_low4.6%
0%20%40%60%80%100%

Percentile: 4.6%

CVSS

4.3medium2.0
0246810

CVSS Score: 4.3/10

All CVSS Scores

CVSS 2.0
4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a “BEAST” attack.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-326

Related Vulnerabilities

Recommendations

Source: nvd

We are currently unaware of a practical solution to this problem.WorkaroundsSome vendors have published specific mitigation advice for the attacks related to this issues. Please see the Vendor Information section of this document for more information.The following general workarounds can be effective in mitigating this issue:Prioritize the use of the RC4 algorithm over block ciphers in server softwareNote that this workaround is not feasible to implement on systems that require FIPS-140 compliance since RC4 is not a FIPS-approved cryptographic algorithm.Enable support for TLS 1.1 and/or TLS 1.2 in the web browserEnable support for TLS 1.1 in server softwareNote that both the web servers and the client web browser must support TLS 1.1 or TLS 1.2 for these workarounds to be effective. The session will fallback to an earlier version of the TLS or SSL protocol in the event that either is incompatible with TLS 1.1 or TLS 1.2.

URL: http://www.kb.cert.org/vuls/id/864643

Source: nvd

All cURL users should upgrade to the latest version:
# emerge –sync
# emerge –ask –oneshot –verbose “>=net-misc/curl-7.24.0”

URL: http://security.gentoo.org/glsa/glsa-201203-02.xml

Source: nvd

Before applying this update, make sure all previously-released erratarelevant to your system have been applied.
This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/knowledge/articles/11258

URL: http://rhn.redhat.com/errata/RHSA-2012-0508.html

Vulnerable Software (61)

Type: Configuration

Product: asterisk

Operating System: debian

Trait:
{  "fixed": "1:13.7.2~dfsg-1"}

Source: debian

Type: Configuration

Product: asterisk

Operating System: debian squeeze 6

Trait:
{  "unfixed": true}

Source: debian

Type: Configuration

Product: asterisk

Operating System: debian jessie 8

Trait:
{  "fixed": "1:11.13.1~dfsg-2+deb8u1"}

Source: debian

Type: Configuration

Product: bouncycastle

Operating System: debian

Trait:
{  "fixed": "1.49+dfsg-1"}

Source: debian

Type: Configuration

Product: chromium-browser

Operating System: debian squeeze 6

Trait:
{  "unfixed": true}

Source: debian

Type: Configuration

Product: chromium-browser

Operating System: debian

Trait:
{  "fixed": "15.0.874.106~r107270-1"}

Source: debian

Type: Configuration

Product: curl

Operating System: debian

Trait:
{  "fixed": "7.24.0-1"}

Source: debian

Type: Configuration

Product: cyassl

Operating System: debian

Trait:
{  "unfixed": true}

Source: debian

Type: Configuration

Product: erlang

Operating System: debian

Trait:
{  "fixed": "1:15.b-dfsg-1"}

Source: debian

Type: Configuration

Product: gnutls26

Operating System: debian

Trait:
{  "unfixed": true}

Source: debian