CVE-2011-3389 Weak cryptography in n/a
Man-in-the-middle attackers can decrypt HTTPS traffic to steal HTTP headers via the BEAST attack on vulnerable browsers and operating systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-3389?
CVE-2011-3389 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 6 Sep 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
Weakness: CWE-326
Which versions are affected by CVE-2011-3389?
It affects 15 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Google Chrome, Haxx Curl, Microsoft Internet Explorer, Microsoft Windows and 9 more.
How do I fix CVE-2011-3389?
Apply the vendor's patch.
Is CVE-2011-3389 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-3389 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as CURL-CVE-2011-3389, CVE-2004-2770, DEBIAN-CVE-2011-3389, ECHO-3dd2-4e3e-f5c6, GHSA-rhch-pcq2-7gp3, MINI-9wph-75f8-j492 and 7 more.