What’s Vulnerable › Vulnerabilities

CVE-2011-3389

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 73.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-09-06 · updated 2026-10-09
• Weakness: CWE-326

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Affected products

• Canonical Ubuntu Linux: 10.04, 10.10, 11.04, 11.10
• Debian Linux: 5.0, 6.0
• Google Chrome: all versions
• curl: from 7.10.6 through 7.23.1
• Microsoft Internet Explorer 11: all versions
• Microsoft Corporation Windows: all versions
• Mozilla Firefox: all versions
• Opera Browser: all versions
• RedHat Enterprise Linux Desktop: 5.0, 6.0
• RedHat Enterprise Linux Eus: 6.2
• RedHat Enterprise Linux Server: 5.0, 6.0
• RedHat Enterprise Linux Server Aus: 6.2
• RedHat Enterprise Linux Workstation: 5.0, 6.0
• Siemens Simatic Rf615R Firmware: before 3.2.1 — fixed in 3.2.1
• Siemens Simatic Rf68Xr Firmware: before 3.2.1 — fixed in 3.2.1

How to fix

Upgrade to a fixed version: Siemens Simatic Rf615R Firmware 3.2.1; Siemens Simatic Rf68Xr Firmware 3.2.1. Check the vendor advisory for mitigations.

References

• http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/
• http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx
• http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx
• http://curl.haxx.se/docs/adv_20120124B.html
• http://downloads.asterisk.org/pub/security/AST-2016-001.html
• http://ekoparty.org/2011/juliano-rizzo.php
• http://eprint.iacr.org/2004/111
• http://eprint.iacr.org/2006/136
• http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html
• http://isc.sans.edu/diary/SSL+TLS+part+3+/11635
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html

Get alerted when CVE-2011-3389 or the next vulnerability affects your stack