Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cvelistMitreCVELIST:CVE-2011-3389
HistorySep 06, 2011 - 7:00 p.m.

CVE-2011-3389

2011-09-0619:00:00
mitre
www.cve.org
2

6.4 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.3%

JSON

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a “BEAST” attack.

References

Related

openvas 77
mskb 1
fedora 25
veracode 2
prion 1
nessus 41
debiancve 1
checkpoint_security 1
ibm 9
cert 1
checkpoint_advisories 2
securityvulns 11
freebsd 3
ubuntucve 1
debian 6
ics 2
seebug 2
nvd 2
cve 2
rubygems 1
f5 2
osv 4
rapid7blog 1
gentoo 1
openvas
openvas
Fedora Update for thunderbird FEDORA-2011-17399
2012-01-23 00:00:00
FreeBSD Ports: fetchmail
2012-08-30 00:00:00
Fedora Update for thunderbird-lightning FEDORA-2011-17400
2012-04-02 00:00:00
mskb
mskb
MS12-006: Vulnerability in SSL/TLS could allow information disclosure: January 10, 2012
2012-01-10 00:00:00
fedora
fedora
[SECURITY] Fedora 16 Update: xulrunner-9.0-2.fc16
2011-12-23 03:31:27
[SECURITY] Fedora 16 Update: nss-softokn-3.13.1-14.fc16
2011-12-23 03:31:27
[SECURITY] Fedora 16 Update: thunderbird-9.0-4.fc16
2011-12-23 03:31:27
veracode
veracode
Man-in-the-Middle (MitM)
2019-05-02 04:55:58
Blockwise Chosen-boundary Attacks
2017-04-27 06:38:37
prion
prion
Session fixation
2011-09-06 19:55:00
nessus
nessus
Oracle Fusion Middleware Security Service Information Disclosure (January 2015 CPU) (BEAST)
2015-01-27 00:00:00
MS12-006: Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584)
2012-01-10 00:00:00
Kerio Connect < 8.1.0 SSL/TLS Information Disclosure (BEAST)
2014-02-07 00:00:00
debiancve
debiancve
CVE-2011-3389
2011-09-06 19:55:03
checkpoint_security
checkpoint_security
Check Point response to CVE-2011-3389 aka BEAST attack
2012-10-15 22:00:00
ibm
ibm
Security Bulletin: Vulnerabilities in SSL and TLS protocols affect the IBM FlashSystem V840 (CVE-2011-3389)
2018-06-18 00:09:28
Security Bulletin: IBM System x and Flex Systems Browser Exploit Against SSL/TLS (BEAST) Mitigations (CVE-2011-3389)
2022-05-16 16:03:13
Security Bulletin: BEAST security vulnerability in IBM Tivoli Netcool Performance Manager for Wireline( CVE-2011-3389)
2020-08-25 12:33:00
cert
cert
SSL 3.0 and TLS 1.0 allow chosen plaintext attack in CBC modes
2011-09-27 00:00:00
checkpoint_advisories
checkpoint_advisories
Web Servers SSL Flooding Denial of Service (CVE-2011-3389)
2011-11-06 00:00:00
Preemptive Protection against SSL and TLS Protocols Information Disclosure (MS12-006; CVE-2011-3389)
2012-01-10 00:00:00
securityvulns
securityvulns
ESA-2012-032: RSA BSAFE® Micro Edition Suite Security Update for BEAST &#40;Browser Exploit Against SSL/TLS&#41; attacks
2014-05-05 00:00:00
ESA-2012-032: RSA BSAFE&#40;r&#41; Micro Edition Suite Security Update for BEAST &#40;Browser Exploit Against SSL/TLS&#41; attacks
2012-10-29 00:00:00
lighthttpd security vulnerabilities
2012-01-02 00:00:00
freebsd
freebsd
fetchmail -- chosen plaintext attack against SSL CBC initialization vectors
2012-01-19 00:00:00
asterisk -- Multiple vulnerabilities
2016-02-03 00:00:00
opera -- multiple vulnerabilities
2011-12-06 00:00:00
ubuntucve
ubuntucve
CVE-2011-3389
2011-11-16 00:00:00
debian
debian
[SECURITY] [DSA 2398-2] curl regression
2012-03-31 19:38:57
[SECURITY] [DSA 2398-1] curl security update
2012-01-30 19:49:07
[SECURITY] [DSA 2368-1] lighttpd security update
2011-12-21 00:24:51
ics
ics
Siemens Ruggedcom WIN Products BEAST Attack Vulnerability
2018-09-06 12:00:00
Siemens SIMATIC RF6XXR
2019-07-11 12:00:00
seebug
seebug
Microsoft Windows SSL/TLS信息泄露漏洞
2011-09-29 00:00:00
Apple XCode 4.x 信息泄露漏洞
2012-07-27 00:00:00
nvd
nvd
CVE-2011-3389
2011-09-06 19:55:03
CVE-2004-2770
2011-09-25 10:55:04
cve
cve
CVE-2011-3389
2011-09-06 19:55:03
CVE-2004-2770
2011-09-25 10:55:04
rubygems
rubygems
CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
2011-08-31 00:00:00
f5
f5
K13400 : SSL 3.0/TLS 1.0 vulnerability CVE-2011-3389 and TLS protocol vulnerability CVE-2012-1870
2015-06-16 00:00:00
SOL13400 - SSL 3.0/TLS 1.0 BEAST vulnerability CVE-2011-3389 and TLS protocol vulnerability CVE-2012-1870
2012-03-06 00:00:00
osv
osv
lighttpd - several
2011-12-20 00:00:00
curl - several
2012-03-31 00:00:00
nss - security update
2015-02-16 00:00:00
rapid7blog
rapid7blog
New Rapid7 MDR Essentials Capability Sees What Attackers See: “It’s Eye-Opening”
2021-09-01 13:11:33
gentoo
gentoo
cURL: Multiple vulnerabilities
2012-03-06 00:00:00

6.4 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.3%

JSON
Related for CVELIST:CVE-2011-3389
openvas77mskb1fedora25veracode2prion1nessus41debiancve1checkpoint_security1ibm9cert1checkpoint_advisories2securityvulns11freebsd3ubuntucve1debian6ics2seebug2nvd2cve2rubygems1f52osv4rapid7blog1gentoo1