CVE-2011-3389

01/תיאור (מקור, אנגלית)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

02/מוצרים מושפעים

google: chrome; microsoft: internet explorer; mozilla: firefox; opera: opera browser; microsoft: windows; siemens: simatic rf68xr firmware; siemens: simatic rf68xr; siemens: simatic rf615r firmware; siemens: simatic rf615r; haxx: curl; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux workstation

03/קישורים10

• googlechromereleases.blogspot.com/2011/10/chrome-stable-releas‮… Not ApplicableVendor Advisory
• technet.microsoft.com/security/advisory/2588513 PatchVendor Advisory
• www.opera.com/support/kb/view/1004/ Third Party AdvisoryVendor Advisory
• www.redhat.com/support/errata/RHSA-2011-1384.html Third Party AdvisoryVendor Advisory
• docs.microsoft.com/en-us/security-updates/securitybulletins/20‮… PatchVendor Advisory
• googlechromereleases.blogspot.com/2011/10/chrome-stable-releas‮… Not ApplicableVendor Advisory
• technet.microsoft.com/security/advisory/2588513 PatchVendor Advisory
• www.opera.com/support/kb/view/1004/ Third Party AdvisoryVendor Advisory
• www.redhat.com/support/errata/RHSA-2011-1384.html Third Party AdvisoryVendor Advisory
• docs.microsoft.com/en-us/security-updates/securitybulletins/20‮… PatchVendor Advisory