CVE-2011-3389
Medium
Description
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Google Chrome
PublishedSep 6, 2011
First seenSep 6, 2011
How to fix
Update
- siemens simatic_rf68xr_firmware3.2.1 or later
- siemens simatic_rf615r_firmware3.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google chrome | No range specified | — |
| microsoft internet_explorer | No range specified | — |
| mozilla firefox | No range specified | — |
| opera opera_browser | No range specified | — |
| microsoft windows | No range specified | — |
| siemens simatic_rf68xr_firmware | v < 3.2.1 | 3.2.1 |
| siemens simatic_rf615r_firmware | v < 3.2.1 | 3.2.1 |
| haxx curl | 7.10.6 ≤ v ≤ 7.23.1 | — |
| redhat enterprise_linux_desktop | 5.0, 6.0 | — |
| redhat enterprise_linux_eus | 6.2 | — |
| redhat enterprise_linux_server | 5.0, 6.0 | — |
| redhat enterprise_linux_server_aus | 6.2 | — |
| redhat enterprise_linux_workstation | 5.0, 6.0 | — |
| debian debian_linux | 5.0, 6.0 | — |
| canonical ubuntu_linux | 10.04, 10.10, 11.04, 11.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.