Skip to navigation

CVE Database

CVE-2011-3389

Impact: Moderate
Public: 2011-09-10
Bugzilla: 737506: CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
IAVA: 2012-B-0006

Details

The MITRE CVE dictionary describes this issue as:

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Find out more about CVE-2011-3389 from the MITRE CVE dictionary and NIST NVD.

Statement

Red Hat is aware of, and tracking, the Rizzo/Duong chosen plain text attack on SSL/TLS 1.0, also known as "BEAST". This issue has been assigned CVE-2011-3389. This attack uses web browser extensions to exploit a weakness in SSL/TLS cipher-block chaining (CBC), allowing a man-in-the-middle attacker to recover certain session information, such as cookie data, from what should be a secure connection.

The research shows two ways that an attacker could mount an attack. In both cases the attacker needs access to the data stream from the web browser to the server while a user visits a malicious website using a browser. The attacker may then be able to determine a portion of the data the browser sends to the server by making a large number of requests over a period of time. This data could include information such as an authentication cookie.

The first method of attack involves using WebSockets. Currently, Red Hat does not ship any products that allow an attack using WebSockets to be successful. We are planning to update Firefox to version 7, which contains protections in the WebSocket code that prevents this particular attack from being effective.

The second method of attack involves using a malicious Java applet. In order for the attack to be successful, the attacker would need to circumvent the Same Origin Policy (SOP) controls in Java. The researchers claim to have found a flaw in the Java SOP and we will issue updates to correct this flaw as suitable fixes are available.

We are in contact with various upstream projects regarding this attack. As a precautionary measure, we plan to update the Network Security Services (NSS), GnuTLS, and OpenSSL packages as suitable fixes are available.

We will continue to track this issue and take any appropriate actions as needed.

This statement and any updates to it is available at:
https://bugzilla.redhat.com/show_bug.cgi?id=737506

CVSS v2 metrics

Base Score: 4.3
Base Metrics: AV:N/AC:M/Au:N/C:P/I:N/A:N
Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat security errata

Platform Errata Release Date
RHEL 4 AS for SAP (java-1.4.2-ibm-sap) RHSA-2012:0343 February 29, 2012
RHEL 5 Server for SAP (java-1.4.2-ibm-sap) RHSA-2012:0343 February 29, 2012
Red Hat Enterprise Linux Server Supplementary (v. 5) (java-1.4.2-ibm) RHSA-2012:0006 January 09, 2012
Red Hat Enterprise Linux Server Supplementary (v. 5) (java-1.5.0-ibm) RHSA-2012:0508 April 23, 2012
Red Hat Enterprise Linux Server Supplementary (v. 5) (java-1.6.0-ibm) RHSA-2012:0034 January 18, 2012
Red Hat Enterprise Linux Server Supplementary (v. 5) (java-1.6.0-sun) RHSA-2011:1384 October 19, 2011
Red Hat Enterprise Linux Supplementary version 6 (java-1.5.0-ibm) RHSA-2012:0508 April 23, 2012
Red Hat Enterprise Linux Supplementary version 6 (java-1.6.0-ibm) RHSA-2012:0034 January 18, 2012
Red Hat Enterprise Linux Supplementary version 6 (java-1.6.0-sun) RHSA-2011:1384 October 19, 2011
Red Hat Enterprise Linux version 4 Extras (java-1.4.2-ibm) RHSA-2012:0006 January 09, 2012
Red Hat Enterprise Linux version 4 Extras (java-1.6.0-ibm) RHSA-2012:0034 January 18, 2012
Red Hat Enterprise Linux version 4 Extras (java-1.6.0-sun) RHSA-2011:1384 October 19, 2011
Red Hat Enterprise Linux version 5 (java-1.6.0-openjdk) RHSA-2011:1380 October 18, 2011
Red Hat Enterprise Linux version 6 (java-1.6.0-openjdk) RHSA-2011:1380 October 18, 2011
Red Hat Satellite 5.4 (RHEL v.5) (java-1.6.0-ibm) RHSA-2013:1455 October 23, 2013
Red Hat Satellite 5.4 (RHEL v.6) (java-1.6.0-ibm) RHSA-2013:1455 October 23, 2013

External References

This page is generated automatically and has not been checked for errors or omissions.

For clarification or corrections please contact the Red Hat Security Response Team.