CVE-2011-3389
Summary
| CVE | CVE-2011-3389 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-09-06 19:55:03 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 10.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 10.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 11.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 11.10 | All | All | All |
| Operating System | Debian | Debian Linux | 5.0 | All | All | All |
| Operating System | Debian | Debian Linux | 6.0 | All | All | All |
| Application | Chrome | - | All | All | All | |
| Application | Haxx | Curl | All | All | All | All |
| Application | Microsoft | Internet Explorer | - | All | All | All |
| Operating System | Microsoft | Windows | - | All | All | All |
| Application | Mozilla | Firefox | - | All | All | All |
| Application | Opera | Opera Browser | - | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 5.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Eus | 6.2 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 5.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 6.2 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 5.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 6.0 | All | All | All |
| Hardware | Siemens | Simatic Rf615r | - | All | All | All |
| Operating System | Siemens | Simatic Rf615r Firmware | All | All | All | All |
| Hardware | Siemens | Simatic Rf68xr | - | All | All | All |
| Operating System | Siemens | Simatic Rf68xr Firmware | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| '[security bulletin] HPSBUX02760 SSRT100805 rev.1 - HP-UX Running Java, Remote Unauthorized Access, D' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| access.redhat.com | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Third Party Advisory, Vendor Advisory |
| '[security bulletin] HPSBUX02730 SSRT100710 rev.1 - HP-UX Running Java, Remote Unauthorized Access, D' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| Multiple vulnerabilities in fetchmail (Third Party Vulnerability Resolution Blog) | af854a3a-2127-422b-91ae-364da2661108 | blogs.oracle.com | Third Party Advisory |
| [security-announce] SUSE-SU-2012:0602-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Broken Link |
| Opera Web Browser Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| ekoparty Security Conference | af854a3a-2127-422b-91ae-364da2661108 | ekoparty.org | Broken Link |
| Opera 11.60 for Mac changelog | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory |
| IBM WebSphere DataPower Lets Remote Users Decrypt SSL/TLS Traffic - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Broken Link, Third Party Advisory, VDB Entry |
| About the security content of iOS 5 Software Update | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| Opera 11.51 for Windows changelog | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory |
| ISC Diary | SSL/TLS (part 3) | af854a3a-2127-422b-91ae-364da2661108 | isc.sans.edu | Third Party Advisory |
| Cryptology ePrint Archive: Report 2004/111 | af854a3a-2127-422b-91ae-364da2661108 | eprint.iacr.org | Third Party Advisory |
| The Opera Security group - The "BEAST" SSL/TLS issue | af854a3a-2127-422b-91ae-364da2661108 | my.opera.com | Third Party Advisory |
| Oracle Fusion Middleware Flaws Let Remote Users Deny Service and Partially Access and Modify Data - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Broken Link, Third Party Advisory, VDB Entry |
| SecurityTracker: Microsoft Windows SSL/TLS Protocol Flaw Lets Remote Users Decryption Sessions | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Broken Link, Third Party Advisory, VDB Entry |
| [security-announce] SUSE-SU-2012:0122-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Broken Link |
| Philips Intellispace Portal ISP Vulnerabilities | ICS-CERT | af854a3a-2127-422b-91ae-364da2661108 | ics-cert.us-cert.gov | Third Party Advisory, US Government Resource |
| APPLE-SA-2011-10-12-2 Apple TV Software Update 4.4 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link |
| Microsoft Security Advisory 2588513 | Microsoft Docs | af854a3a-2127-422b-91ae-364da2661108 | technet.microsoft.com | Patch, Vendor Advisory |
| Security Advisory SA48256 - Gentoo update for curl - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| USN-1263-1: IcedTea-Web, OpenJDK 6 vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | Third Party Advisory |
| About the security content of OS X Mavericks v10.9.2 and Security Update 2014-001 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| hermes.opensuse.org/messages/13155432 | af854a3a-2127-422b-91ae-364da2661108 | hermes.opensuse.org | Broken Link |
| Opera 11.60 for Windows changelog | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory |
| Oracle Critical Patch Update - July 2015 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| AST-2016-001 | af854a3a-2127-422b-91ae-364da2661108 | downloads.asterisk.org | Third Party Advisory |
| Debian -- Security Information -- DSA-2398-2 curl | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | Broken Link |
| Gentoo Linux Documentation -- cURL: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| APPLE-SA-2012-07-25-2 Xcode 4.4 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link, Mailing List |
| osvdb.org/74829 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| [security-announce] SUSE-SU-2012:0114-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Broken Link |
| cURL - Security Advisory (SSL CBC IV vulnerability) | af854a3a-2127-422b-91ae-364da2661108 | curl.haxx.se | Third Party Advisory |
| Is SSL broken? – More about Security Advisory 2588513 - Security Research & Defense - Site Home - TechNet Blogs | af854a3a-2127-422b-91ae-364da2661108 | blogs.technet.com | Third Party Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| www.mandriva.com | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| developerWorks : Java™; technology : IBM developer kits : Additional documentation | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | Third Party Advisory |
| Please wait... | af854a3a-2127-422b-91ae-364da2661108 | www.apcmedia.com | Third Party Advisory |
| About the security content of OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| About the security content of OS X Lion v10.7.4 and Security Update 2012-002 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Broken Link |
| '[security bulletin] HPSBMU02799 SSRT100867 rev.1 - HP Network Node Manager i (NNMi) v9.0x Running JD' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| Security Advisory SA55351 - Oracle Forms and Reports Two Weaknesses - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| VU#864643 - SSL 3.0 and TLS 1.0 allow chosen plaintext attack in CBC modes | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | Third Party Advisory, US Government Resource |
| Chrome Releases: Chrome Stable Release | af854a3a-2127-422b-91ae-364da2661108 | googlechromereleases.blogspot.com | Not Applicable, Vendor Advisory |
| About the security content of OS X Lion v10.7.3 and Security Update 2012-001 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| hermes.opensuse.org/messages/13154861 | af854a3a-2127-422b-91ae-364da2661108 | hermes.opensuse.org | Broken Link |
| [security-announce] openSUSE-SU-2020:0086-1: important: Security update | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Broken Link |
| cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf | af854a3a-2127-422b-91ae-364da2661108 | cert-portal.siemens.com | Third Party Advisory |
| access.redhat.com | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Third Party Advisory |
| Oracle Java Critical Patch Update - October 2011 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Attack against TLS-protected communications at Mozilla Security Blog | af854a3a-2127-422b-91ae-364da2661108 | blog.mozilla.com | Third Party Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Opera 11.51 for Mac changelog | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory |
| APPLE-SA-2011-10-12-1 iOS 5 Software Update | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link |
| Gentoo Linux Documentation -- IcedTea JDK: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| APPLE-SA-2013-10-22-3 OS X Mavericks v10.9 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link, Mailing List |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | Third Party Advisory |
| Opera 11.60 for UNIX changelog | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory |
| APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link, Mailing List |
| A weakness in the SSL v3.0 and TLS 1.0 specifications can allow eavesdropping attacks against some applications - Opera Knowledge Base | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory, Vendor Advisory |
| '[security bulletin] HPSBUX02777 SSRT100854 rev.1 - HP-UX Running Java JRE and JDK, Remote Denial' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| thái: BEAST | af854a3a-2127-422b-91ae-364da2661108 | vnhacker.blogspot.com | Third Party Advisory |
| '[security bulletin] HPSBMU02742 SSRT100740 rev.1 - HP System Management Homepage (SMH) for Linux and' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| Microsoft Security Bulletin MS12-006 - Important | Microsoft Docs | af854a3a-2127-422b-91ae-364da2661108 | docs.microsoft.com | Patch, Vendor Advisory |
| APPLE-SA-2012-05-09-1 OS X Lion v10.7.4 and Security Update 2012-002 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link, Mailing List |
| Security impact of the Rizzo/Duong CBC "BEAST" attack - Educated Guesswork | af854a3a-2127-422b-91ae-364da2661108 | www.educatedguesswork.org | Broken Link |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| SecurityTracker: Opera Lets Remote Users Spoof Extended Validation Address Bar Security Information and Decrypt SSL/TLS Traffic | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Broken Link, Third Party Advisory, VDB Entry |
| '[security bulletin] HPSBMU02797 SSRT100867 rev.1 - HP Network Node Manager i (NNMi) v9.1x Running JD' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| About the security content of Apple TV Software Update 4.4 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| Access Denied | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.novell.com | Issue Tracking, Third Party Advisory |
| ImperialViolet - Chrome and the BEAST | af854a3a-2127-422b-91ae-364da2661108 | www.imperialviolet.org | Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | Third Party Advisory |
| Cryptology ePrint Archive: Report 2006/136 | af854a3a-2127-422b-91ae-364da2661108 | eprint.iacr.org | Third Party Advisory |
| Microsoft releases Security Advisory 2588513 - MSRC - Site Home - TechNet Blogs | af854a3a-2127-422b-91ae-364da2661108 | blogs.technet.com | Third Party Advisory |
| 737506 – (BEAST, CVE-2011-3389) CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST) | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| US-CERT Alert TA12-010A - Microsoft Updates for Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | Third Party Advisory, US Government Resource |
| Oracle Critical Patch Update - January 2015 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| Security Advisory SA55350 - Oracle Fusion Middleware Two Information Disclosure Weaknesses - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Opera 11.51 for UNIX changelog | af854a3a-2127-422b-91ae-364da2661108 | www.opera.com | Third Party Advisory |
| h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay | af854a3a-2127-422b-91ae-364da2661108 | h20564.www2.hp.com | Broken Link |
| theagora.io | af854a3a-2127-422b-91ae-364da2661108 | www.insecure.cl | Broken Link, Patch |
| APPLE-SA-2012-09-19-2 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link, Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 390279 Oracle Managed Virtualization (VM) Server for x86 Security Update for nss (OVMSA-2023-0014)