CVE-2011-3389
40Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 73%
de la publicación al arma1134 días
Publicada en NVD6 sept
metasploit+1134d
probabilidad de explotación
73%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
Productos afectados
n/a · n/aReferencias
http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspxhttp://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspxhttp://curl.haxx.se/docs/adv_20120124B.htmlhttp://downloads.asterisk.org/pub/security/AST-2016-001.htmlhttp://ekoparty.org/2011/juliano-rizzo.phphttp://eprint.iacr.org/2004/111http://eprint.iacr.org/2006/136http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.htmlhttp://isc.sans.edu/diary/SSL+TLS+part+3+/11635http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.htmlhttp://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html