CVE-2011-3389

תיאור (מקור, אנגלית)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

מדדים

EPSS — סבירות ניצול

73% (אחוזון 100) נכון ל-11/10/2026

CWE

CWE-326

מוצרים מושפעים

google: chrome; microsoft: internet explorer; mozilla: firefox; opera: opera browser; microsoft: windows; siemens: simatic rf68xr firmware; siemens: simatic rf68xr; siemens: simatic rf615r firmware; siemens: simatic rf615r; haxx: curl; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux workstation

קישורים

• http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html Not ApplicableVendor Advisory
• http://technet.microsoft.com/security/advisory/2588513 PatchVendor Advisory
• http://www.opera.com/support/kb/view/1004/ Third Party AdvisoryVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2011-1384.html Third Party AdvisoryVendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-‮… PatchVendor Advisory
• http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html Not ApplicableVendor Advisory
• http://technet.microsoft.com/security/advisory/2588513 PatchVendor Advisory
• http://www.opera.com/support/kb/view/1004/ Third Party AdvisoryVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2011-1384.html Third Party AdvisoryVendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-‮… PatchVendor Advisory