CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

From the Ubuntu Security Team

Juliano Rizzo and Thai Duong discovered that the block-wise AES encryption algorithm block-wise as used in TLS/SSL was vulnerable to a chosen-plaintext attack. This could allow a remote attacker to view confidential data.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnutls26	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not in release
icedtea-web	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not in release
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not in release
lighttpd	12.10 quantal	Ignored
	12.04 LTS precise	Ignored
	11.10 oneiric	Ignored
	11.04 natty	Ignored
	10.10 maverick	Ignored
	10.04 LTS lucid	Ignored
	8.04 LTS hardy	Ignored end of life
openjdk-6	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Fixed 6b23~pre11-0ubuntu1.11.10
	11.04 natty	Fixed 6b22-1.10.4-0ubuntu1~11.04.1
	10.10 maverick	Fixed 6b20-1.9.10-0ubuntu1~10.10.2
	10.04 LTS lucid	Fixed 6b20-1.9.10-0ubuntu1~10.04.2
	8.04 LTS hardy	Fixed 6b27-1.12.3-0ubuntu1~08.04.1
openjdk-6b18	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Ignored end of life
	11.04 natty	Fixed 6b18-1.8.10-0ubuntu1~11.04.1
	10.10 maverick	Fixed 6b18-1.8.10-0ubuntu1~10.10.2
	10.04 LTS lucid	Fixed 6b18-1.8.10-0ubuntu1~10.04.2
	8.04 LTS hardy	Not in release
openjdk-7	12.10 quantal	Fixed 7~b147-2.0-1ubuntu1
	12.04 LTS precise	Fixed 7~b147-2.0-1ubuntu1
	11.10 oneiric	Fixed 7~b147-2.0-0ubuntu0.11.10.1
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
openssl	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not affected
sun-java5	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Ignored end of life
sun-java6	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Ignored end of life

Notes

mdeslaur

in natty+, NetX and the plugin moved to the icedtea-web package

jdstrand

this is not a lighttpd issue, however dsa-2368 disabled CBC ciphers by default. Ignoring as this is a configuration issue.

sbeattie

openssl contains a countermeasure since openssl 0.9.8d, though it can be disabled with the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS option (which is included in SSL_OP_ALL). Need to search through openssl user that enable the option.

tyhicks

All versions of gnutls in supported releases have TLS 1.1 and 1.2 support. TLS 1.1 and 1.2 are not affected by this attack. Upstream advised applications to use 1.1 and 1.2 in GNUTLS-SA-2011-1. Additionally, DTLS 1.0 can be used or RC4 can be used with TLS 1.0 if TLS 1.1 or 1.2 are not viable options.

jdstrand

arcticdog blog points out that users of SSL_OP_ALL should be updated to use 'SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS' to not be vulnerable to this attack

mdeslaur

removing SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS will break compatibility with certain SSL implementations, which is why it's included in SSL_OP_ALL in the first place. Since the BEAST attack is only practical in web browsers where you can run arbitrary code, and current web browsers are already fixed, modifying other software in the archive to enable the work around will break compatibility with no added security benefit.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
lighttpd	Vendor: http://www.debian.org/security/2011/dsa-2368

References

Related Ubuntu Security Notices (USN)