CVE-2011-3389

中 4.3CVE-2011-3389 · 06/09/2011 公開 · 09/10/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
curl haxx	`≥ 7.10.6, ≤ 7.23.1`	修正版なし

概要

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

参考情報

blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications · Third Party Advisory
blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx · Third Party Advisory
blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx · Third Party Advisory
curl.haxx.se/docs/adv_20120124B.html · Third Party Advisory
downloads.asterisk.org/pub/security/AST-2016-001.html · Third Party Advisory
ekoparty.org/2011/juliano-rizzo.php · Broken Link
eprint.iacr.org/2004/111 · Third Party Advisory
eprint.iacr.org/2006/136 · Third Party Advisory
googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html · Not Applicable
isc.sans.edu/diary/SSL+TLS+part+3+/11635 · Third Party Advisory
lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html · Broken Link
lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html · Broken Link
lists.apple.com/archives/security-announce/2012/Feb/msg00000.html · Broken Link
lists.apple.com/archives/security-announce/2012/Jul/msg00001.html · Broken Link
lists.apple.com/archives/security-announce/2012/May/msg00001.html · Broken Link
lists.apple.com/archives/security-announce/2012/Sep/msg00004.html · Broken Link
lists.apple.com/archives/security-announce/2013/Oct/msg00004.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · Broken Link
marc.info · Issue Tracking
marc.info · Issue Tracking
marc.info · Issue Tracking
marc.info · Issue Tracking
marc.info · Issue Tracking
marc.info · Issue Tracking
my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue · Third Party Advisory
osvdb.org/74829 · Broken Link
rhn.redhat.com/errata/RHSA-2012-0508.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-1455.html · Broken Link
secunia.com/advisories/45791 · Not Applicable
secunia.com/advisories/47998 · Not Applicable
secunia.com/advisories/48256 · Not Applicable
secunia.com/advisories/48692 · Not Applicable
secunia.com/advisories/48915 · Not Applicable
secunia.com/advisories/48948 · Not Applicable
secunia.com/advisories/49198 · Not Applicable
secunia.com/advisories/55322 · Not Applicable
secunia.com/advisories/55350 · Not Applicable
secunia.com/advisories/55351 · Not Applicable
security.gentoo.org/glsa/glsa-201203-02.xml · Third Party Advisory
security.gentoo.org/glsa/glsa-201406-32.xml · Third Party Advisory
support.apple.com/kb/HT4999 · Third Party Advisory
support.apple.com/kb/HT5001 · Third Party Advisory
support.apple.com/kb/HT5130 · Third Party Advisory
support.apple.com/kb/HT5281 · Broken Link
support.apple.com/kb/HT5501 · Third Party Advisory
support.apple.com/kb/HT6150 · Third Party Advisory
technet.microsoft.com/security/advisory/2588513 · Patch
vnhacker.blogspot.com/2011/09/beast.html · Third Party Advisory
apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf · Third Party Advisory
debian.org/security/2012/dsa-2398 · Third Party Advisory
educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html · Broken Link
ibm.com/developerworks/java/jdk/alerts · Third Party Advisory
imperialviolet.org/2011/09/23/chromeandbeast.html · Third Party Advisory
insecure.cl/Beast-SSL.rar · Broken Link
kb.cert.org/vuls/id/864643 · Third Party Advisory
mandriva.com/security/advisories · Broken Link
opera.com/docs/changelogs/mac/1151 · Third Party Advisory
opera.com/docs/changelogs/mac/1160 · Third Party Advisory
opera.com/docs/changelogs/unix/1151 · Third Party Advisory
opera.com/docs/changelogs/unix/1160 · Third Party Advisory
opera.com/docs/changelogs/windows/1151 · Third Party Advisory
opera.com/docs/changelogs/windows/1160 · Third Party Advisory
opera.com/support/kb/view/1004 · Third Party Advisory
oracle.com/technetwork/topics/security/cpujan2015-1972971.html · Third Party Advisory
oracle.com/technetwork/topics/security/cpujul2015-2367936.html · Third Party Advisory
oracle.com/technetwork/topics/security/javacpuoct2011-443431.html · Third Party Advisory
redhat.com/support/errata/RHSA-2011-1384.html · Third Party Advisory
redhat.com/support/errata/RHSA-2012-0006.html · Third Party Advisory
securityfocus.com/bid/49388 · Third Party Advisory
securityfocus.com/bid/49778 · Third Party Advisory
securitytracker.com/id/1029190 · Broken Link
securitytracker.com/id · Broken Link
securitytracker.com/id · Broken Link
securitytracker.com/id · Broken Link
ubuntu.com/usn/USN-1263-1 · Third Party Advisory
us-cert.gov/cas/techalerts/TA12-010A.html · Third Party Advisory
blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail · Third Party Advisory
bugzilla.novell.com/show_bug.cgi · Issue Tracking
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006 · Patch
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay · Broken Link
hermes.opensuse.org/messages/13154861 · Broken Link
hermes.opensuse.org/messages/13155432 · Broken Link
ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752 · Third Party Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン