CVE-2011-3389
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2011-3389 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
Red Hat is aware of, and tracking, the Rizzo/Duong chosen plain text attack on SSL/TLS 1.0, also known as "BEAST". This issue has been assigned CVE-2011-3389. This attack uses web browser extensions to exploit a weakness in SSL/TLS cipher-block chaining (CBC), allowing a man-in-the-middle attacker to recover certain session information, such as cookie data, from what should be a secure connection.
The research shows two ways that an attacker could mount an attack. In both cases the attacker needs access to the data stream from the web browser to the server while a user visits a malicious website using a browser. The attacker may then be able to determine a portion of the data the browser sends to the server by making a large number of requests over a period of time. This data could include information such as an authentication cookie.
The first method of attack involves using WebSockets. Currently, Red Hat does not ship any products that allow an attack using WebSockets to be successful. We are planning to update Firefox to version 7, which contains protections in the WebSocket code that prevents this particular attack from being effective.
The second method of attack involves using a malicious Java applet. In order for the attack to be successful, the attacker would need to circumvent the Same Origin Policy (SOP) controls in Java. The researchers claim to have found a flaw in the Java SOP and we will issue updates to correct this flaw as suitable fixes are available.
We are in contact with various upstream projects regarding this attack. As a precautionary measure, we plan to update the Network Security Services (NSS), GnuTLS, and OpenSSL packages as suitable fixes are available.
We will continue to track this issue and take any appropriate actions as needed.
This statement and any updates to it is available at:
https://bugzilla.redhat.com/show_bug.cgi?id=737506
CVSS v2 metrics
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux Supplementary (v. 6) (java-1.6.0-sun) | RHSA-2011:1384 | 2011-10-19 |
| Red Hat Enterprise Linux Supplementary (v. 6) (java-1.6.0-ibm) | RHSA-2012:0034 | 2012-01-18 |
| Red Hat Enterprise Linux 5 (java-1.6.0-openjdk) | RHSA-2011:1380 | 2011-10-18 |
| Red Hat Enterprise Linux Supplementary 5 (java-1.6.0-sun) | RHSA-2011:1384 | 2011-10-19 |
| Red Hat Enterprise Linux Supplementary 5 (java-1.4.2-ibm) | RHSA-2012:0006 | 2012-01-09 |
| Red Hat Enterprise Linux Supplementary 5 (java-1.6.0-ibm) | RHSA-2012:0034 | 2012-01-18 |
| Red Hat Enterprise Linux AS version 4 Extras (java-1.6.0-sun) | RHSA-2011:1384 | 2011-10-19 |
| Red Hat Satellite 5.4 (RHEL v.5) (java-1.6.0-ibm) | RHSA-2013:1455 | 2013-10-23 |
| Red Hat Satellite 5.4 (RHEL v.6) (java-1.6.0-ibm) | RHSA-2013:1455 | 2013-10-23 |
| Red Hat Enterprise Linux 6 (java-1.6.0-openjdk) | RHSA-2011:1380 | 2011-10-18 |
| RHEL 5 Server for SAP (java-1.4.2-ibm-sap) | RHSA-2012:0343 | 2012-02-29 |
| Red Hat Enterprise Linux Supplementary (v. 6) (java-1.5.0-ibm) | RHSA-2012:0508 | 2012-04-23 |
| Red Hat Enterprise Linux AS version 4 Extras (java-1.4.2-ibm) | RHSA-2012:0006 | 2012-01-09 |
| Red Hat Enterprise Linux for SAP 6 (java-1.4.2-ibm-sap) | RHSA-2012:0343 | 2012-02-29 |
| RHEL 4 AS for SAP (java-1.4.2-ibm-sap) | RHSA-2012:0343 | 2012-02-29 |
| Red Hat Enterprise Linux AS version 4 Extras (java-1.6.0-ibm) | RHSA-2012:0034 | 2012-01-18 |
| Red Hat Enterprise Linux Supplementary 5 (java-1.5.0-ibm) | RHSA-2012:0508 | 2012-04-23 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | openssl | Will not fix |
| Red Hat Enterprise Linux 6 | gnutls | Will not fix |
| Red Hat Enterprise Linux 6 | nss | Will not fix |
| Red Hat Enterprise Linux 6 | openssl098e | Will not fix |
| Red Hat Enterprise Linux 5 | openssl097a | Will not fix |
| Red Hat Enterprise Linux 5 | openssl | Will not fix |
| Red Hat Enterprise Linux 5 | nss | Will not fix |
| Red Hat Enterprise Linux 5 | gnutls | Will not fix |
| Red Hat Enterprise Linux 4 | nss | Will not fix |
| Red Hat Enterprise Linux 4 | openssl | Will not fix |
| Red Hat Enterprise Linux 4 | openssl096b | Will not fix |
| Red Hat Enterprise Linux 4 | java-1.5.0-ibm | Will not fix |
| Red Hat Enterprise Linux 4 | gnutls | Will not fix |
CVE description copyright © 2017, The MITRE Corporation
