---
id: CVE-2011-3389
title: >-
  The SSL protocol, as used in certain configurations in Microsoft Windows and
  Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other
  products, encrypts data by using CBC mode with chained initialization vectors,
  whi…
summary: >-
  The SSL protocol, as used in certain configurations in Microsoft Windows and
  Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other
  products, encrypts data by using CBC mode with chained initialization vectors,
  whi…
severity: medium
cvss: 4.3
cvssVector: 'AV:N/AC:M/Au:N/C:P/I:N/A:N'
cwe:
  - CWE-326
vendor: google
product: chrome
affected:
  - chrome
  - internet_explorer
  - firefox
  - opera_browser
  - windows
  - simatic_rf68xr_firmware < 3.2.1
  - simatic_rf615r_firmware < 3.2.1
  - 'curl >= 7.10.6, <= 7.23.1'
  - enterprise_linux_desktop = 5.0
  - enterprise_linux_desktop = 6.0
  - enterprise_linux_eus = 6.2
  - enterprise_linux_server = 5.0
  - enterprise_linux_server = 6.0
  - enterprise_linux_server_aus = 6.2
  - enterprise_linux_workstation = 5.0
  - enterprise_linux_workstation = 6.0
  - debian_linux = 5.0
  - debian_linux = 6.0
  - ubuntu_linux = 10.04
  - ubuntu_linux = 10.10
  - ubuntu_linux = 11.04
  - ubuntu_linux = 11.10
patched:
  - simatic_rf68xr_firmware 3.2.1
  - simatic_rf615r_firmware 3.2.1
published: '2011-09-06'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T20:17:02.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2011-3389'
references:
  - url: >-
      http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/
    label: cve@mitre.org
  - url: >-
      http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx
    label: cve@mitre.org
  - url: >-
      http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx
    label: cve@mitre.org
  - url: 'http://curl.haxx.se/docs/adv_20120124B.html'
    label: cve@mitre.org
  - url: 'http://downloads.asterisk.org/pub/security/AST-2016-001.html'
    label: cve@mitre.org
  - url: 'http://ekoparty.org/2011/juliano-rizzo.php'
    label: cve@mitre.org
  - url: 'http://eprint.iacr.org/2004/111'
    label: cve@mitre.org
  - url: 'http://eprint.iacr.org/2006/136'
    label: cve@mitre.org
  - url: >-
      http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html
    label: cve@mitre.org
  - url: 'http://isc.sans.edu/diary/SSL+TLS+part+3+/11635'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/security-announce/2012/May/msg00001.html'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html'
    label: cve@mitre.org
  - url: 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html'
    label: cve@mitre.org
  - url: 'http://marc.info/?l=bugtraq&m=132750579901589&w=2'
    label: cve@mitre.org
  - url: 'http://marc.info/?l=bugtraq&m=132872385320240&w=2'
    label: cve@mitre.org
  - url: 'http://marc.info/?l=bugtraq&m=133365109612558&w=2'
    label: cve@mitre.org
  - url: 'http://marc.info/?l=bugtraq&m=133728004526190&w=2'
    label: cve@mitre.org
  - url: 'http://marc.info/?l=bugtraq&m=134254866602253&w=2'
    label: cve@mitre.org
  - url: 'http://marc.info/?l=bugtraq&m=134254957702612&w=2'
    label: cve@mitre.org
  - url: 'http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue'
    label: cve@mitre.org
  - url: 'http://osvdb.org/74829'
    label: cve@mitre.org
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-0508.html'
    label: cve@mitre.org
  - url: 'http://rhn.redhat.com/errata/RHSA-2013-1455.html'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/45791'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/47998'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/48256'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/48692'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/48915'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/48948'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/49198'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/55322'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/55350'
    label: cve@mitre.org
  - url: 'http://secunia.com/advisories/55351'
    label: cve@mitre.org
  - url: 'http://security.gentoo.org/glsa/glsa-201203-02.xml'
    label: cve@mitre.org
  - url: 'http://security.gentoo.org/glsa/glsa-201406-32.xml'
    label: cve@mitre.org
  - url: 'http://support.apple.com/kb/HT4999'
    label: cve@mitre.org
  - url: 'http://support.apple.com/kb/HT5001'
    label: cve@mitre.org
  - url: 'http://support.apple.com/kb/HT5130'
    label: cve@mitre.org
  - url: 'http://support.apple.com/kb/HT5281'
    label: cve@mitre.org
  - url: 'http://support.apple.com/kb/HT5501'
    label: cve@mitre.org
  - url: 'http://support.apple.com/kb/HT6150'
    label: cve@mitre.org
  - url: 'http://technet.microsoft.com/security/advisory/2588513'
    label: cve@mitre.org
  - url: 'http://vnhacker.blogspot.com/2011/09/beast.html'
    label: cve@mitre.org
  - url: 'http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf'
    label: cve@mitre.org
  - url: 'http://www.debian.org/security/2012/dsa-2398'
    label: cve@mitre.org
  - url: >-
      http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html
    label: cve@mitre.org
  - url: 'http://www.ibm.com/developerworks/java/jdk/alerts/'
    label: cve@mitre.org
  - url: 'http://www.imperialviolet.org/2011/09/23/chromeandbeast.html'
    label: cve@mitre.org
  - url: 'http://www.insecure.cl/Beast-SSL.rar'
    label: cve@mitre.org
  - url: 'http://www.kb.cert.org/vuls/id/864643'
    label: cve@mitre.org
  - url: 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:058'
    label: cve@mitre.org
  - url: 'http://www.opera.com/docs/changelogs/mac/1151/'
    label: cve@mitre.org
  - url: 'http://www.opera.com/docs/changelogs/mac/1160/'
    label: cve@mitre.org
  - url: 'http://www.opera.com/docs/changelogs/unix/1151/'
    label: cve@mitre.org
  - url: 'http://www.opera.com/docs/changelogs/unix/1160/'
    label: cve@mitre.org
  - url: 'http://www.opera.com/docs/changelogs/windows/1151/'
    label: cve@mitre.org
  - url: 'http://www.opera.com/docs/changelogs/windows/1160/'
    label: cve@mitre.org
  - url: 'http://www.opera.com/support/kb/view/1004/'
    label: cve@mitre.org
  - url: 'http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html'
    label: cve@mitre.org
  - url: 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'
    label: cve@mitre.org
  - url: >-
      http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
    label: cve@mitre.org
  - url: 'http://www.redhat.com/support/errata/RHSA-2011-1384.html'
    label: cve@mitre.org
  - url: 'http://www.redhat.com/support/errata/RHSA-2012-0006.html'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/49388'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/49778'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id/1029190'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id?1025997'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id?1026103'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id?1026704'
    label: cve@mitre.org
  - url: 'http://www.ubuntu.com/usn/USN-1263-1'
    label: cve@mitre.org
  - url: 'http://www.us-cert.gov/cas/techalerts/TA12-010A.html'
    label: cve@mitre.org
  - url: >-
      https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail
    label: cve@mitre.org
  - url: 'https://bugzilla.novell.com/show_bug.cgi?id=719047'
    label: cve@mitre.org
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=737506'
    label: cve@mitre.org
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf'
    label: cve@mitre.org
  - url: >-
      https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006
    label: cve@mitre.org
  - url: >-
      https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862
    label: cve@mitre.org
  - url: 'https://hermes.opensuse.org/messages/13154861'
    label: cve@mitre.org
  - url: 'https://hermes.opensuse.org/messages/13155432'
    label: cve@mitre.org
  - url: 'https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02'
    label: cve@mitre.org
  - url: >-
      https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752
    label: cve@mitre.org
  - url: >-
      http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://curl.haxx.se/docs/adv_20120124B.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://downloads.asterisk.org/pub/security/AST-2016-001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://ekoparty.org/2011/juliano-rizzo.php'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://eprint.iacr.org/2004/111'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://eprint.iacr.org/2006/136'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://isc.sans.edu/diary/SSL+TLS+part+3+/11635'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/security-announce/2012/May/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://marc.info/?l=bugtraq&m=132750579901589&w=2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://marc.info/?l=bugtraq&m=132872385320240&w=2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://marc.info/?l=bugtraq&m=133365109612558&w=2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://marc.info/?l=bugtraq&m=133728004526190&w=2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://marc.info/?l=bugtraq&m=134254866602253&w=2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://marc.info/?l=bugtraq&m=134254957702612&w=2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://osvdb.org/74829'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-0508.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://rhn.redhat.com/errata/RHSA-2013-1455.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/45791'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/47998'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/48256'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/48692'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/48915'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/48948'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/49198'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/55322'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/55350'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/55351'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://security.gentoo.org/glsa/glsa-201203-02.xml'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://security.gentoo.org/glsa/glsa-201406-32.xml'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://support.apple.com/kb/HT4999'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://support.apple.com/kb/HT5001'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://support.apple.com/kb/HT5130'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://support.apple.com/kb/HT5281'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://support.apple.com/kb/HT5501'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://support.apple.com/kb/HT6150'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://technet.microsoft.com/security/advisory/2588513'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://vnhacker.blogspot.com/2011/09/beast.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.debian.org/security/2012/dsa-2398'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.ibm.com/developerworks/java/jdk/alerts/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.imperialviolet.org/2011/09/23/chromeandbeast.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.insecure.cl/Beast-SSL.rar'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.kb.cert.org/vuls/id/864643'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:058'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/docs/changelogs/mac/1151/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/docs/changelogs/mac/1160/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/docs/changelogs/unix/1151/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/docs/changelogs/unix/1160/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/docs/changelogs/windows/1151/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/docs/changelogs/windows/1160/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.opera.com/support/kb/view/1004/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.redhat.com/support/errata/RHSA-2011-1384.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.redhat.com/support/errata/RHSA-2012-0006.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/49388'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/49778'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1029190'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id?1025997'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id?1026103'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id?1026704'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.ubuntu.com/usn/USN-1263-1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.us-cert.gov/cas/techalerts/TA12-010A.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.novell.com/show_bug.cgi?id=719047'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=737506'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hermes.opensuse.org/messages/13154861'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hermes.opensuse.org/messages/13155432'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.73327
epssPercentile: 0.99455
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/mpgn/BEAST-PoC'
  metasploit:
    - auxiliary/scanner/ssl/ssl_version
  checkedAt: '2026-10-11T14:25:53.315Z'
exploitAvailable: true
ingestedAt: '2026-10-09T21:12:42.308Z'
---

## Overview

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

## Affected

- `chrome`
- `internet_explorer`
- `firefox`
- `opera_browser`
- `windows`
- `simatic_rf68xr_firmware < 3.2.1`
- `simatic_rf615r_firmware < 3.2.1`
- `curl >= 7.10.6, <= 7.23.1`
- `enterprise_linux_desktop = 5.0`
- `enterprise_linux_desktop = 6.0`
- `enterprise_linux_eus = 6.2`
- `enterprise_linux_server = 5.0`
- `enterprise_linux_server = 6.0`
- `enterprise_linux_server_aus = 6.2`
- `enterprise_linux_workstation = 5.0`
- `enterprise_linux_workstation = 6.0`
- `debian_linux = 5.0`
- `debian_linux = 6.0`
- `ubuntu_linux = 10.04`
- `ubuntu_linux = 10.10`
- `ubuntu_linux = 11.04`
- `ubuntu_linux = 11.10`

## Remediation

Upgrade past the affected range:

- `simatic_rf68xr_firmware 3.2.1`
- `simatic_rf615r_firmware 3.2.1`