Description
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
Metrics
CVSS 2.0 4.3/10
AV:N/AC:M/Au:N/C:P/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/Third Party Advisory
- http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspxThird Party Advisory
- http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspxThird Party Advisory
- http://curl.haxx.se/docs/adv_20120124B.htmlThird Party Advisory
- http://downloads.asterisk.org/pub/security/AST-2016-001.htmlThird Party Advisory
- http://ekoparty.org/2011/juliano-rizzo.phpBroken Link
- http://eprint.iacr.org/2004/111Third Party Advisory
- http://eprint.iacr.org/2006/136Third Party Advisory
- http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.htmlNot Applicable, Vendor Advisory
- http://isc.sans.edu/diary/SSL+TLS+part+3+/11635Third Party Advisory
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.htmlBroken Link
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.htmlBroken Link
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlBroken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.htmlBroken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.htmlBroken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlBroken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.htmlBroken Link, Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlBroken Link
- http://marc.info/?l=bugtraq&m=132750579901589&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=132872385320240&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=133365109612558&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=133728004526190&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134254866602253&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134254957702612&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issueThird Party Advisory
- http://osvdb.org/74829Broken Link
- http://rhn.redhat.com/errata/RHSA-2012-0508.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1455.htmlBroken Link
- http://secunia.com/advisories/45791Not Applicable
- http://secunia.com/advisories/47998Not Applicable
- http://secunia.com/advisories/48256Not Applicable
- http://secunia.com/advisories/48692Not Applicable
- http://secunia.com/advisories/48915Not Applicable
- http://secunia.com/advisories/48948Not Applicable
- http://secunia.com/advisories/49198Not Applicable
- http://secunia.com/advisories/55322Not Applicable
- http://secunia.com/advisories/55350Not Applicable
- http://secunia.com/advisories/55351Not Applicable
- http://security.gentoo.org/glsa/glsa-201203-02.xmlThird Party Advisory
- http://security.gentoo.org/glsa/glsa-201406-32.xmlThird Party Advisory
- http://support.apple.com/kb/HT4999Third Party Advisory
- http://support.apple.com/kb/HT5001Third Party Advisory
- http://support.apple.com/kb/HT5130Third Party Advisory
- http://support.apple.com/kb/HT5281Broken Link
- http://support.apple.com/kb/HT5501Third Party Advisory
- http://support.apple.com/kb/HT6150Third Party Advisory
- http://technet.microsoft.com/security/advisory/2588513Patch, Vendor Advisory
- http://vnhacker.blogspot.com/2011/09/beast.htmlThird Party Advisory
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdfThird Party Advisory
- http://www.debian.org/security/2012/dsa-2398Third Party Advisory
- http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.htmlBroken Link
- http://www.ibm.com/developerworks/java/jdk/alerts/Third Party Advisory
- http://www.imperialviolet.org/2011/09/23/chromeandbeast.htmlThird Party Advisory
- http://www.insecure.cl/Beast-SSL.rarBroken Link, Patch
- http://www.kb.cert.org/vuls/id/864643Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:058Broken Link
- http://www.opera.com/docs/changelogs/mac/1151/Third Party Advisory
Timeline
- Published
- Sep 6, 2011
- Last modified
- Oct 9, 2026
- NVD status
- Modified