The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
Fix
Public exploits 2
- SSL/TLS Version Detection (auxiliary module) Metasploit · 2014-10-14
- mpgn/BEAST-PoC PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 9
- http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html Not Applicable, Vendor Advisory
- http://technet.microsoft.com/security/advisory/2588513 Patch, Vendor Advisory
- http://www.insecure.cl/Beast-SSL.rar Broken Link, Patch
- http://www.opera.com/support/kb/view/1004/ Third Party Advisory, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1384.html Third Party Advisory, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006 Patch, Vendor Advisory
- http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html Not Applicable, Vendor Advisory
- http://technet.microsoft.com/security/advisory/2588513 Patch, Vendor Advisory
- http://www.insecure.cl/Beast-SSL.rar Broken Link, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · google, microsoft, mozillaNVD modified 2026-10-09 20:17
Affected (CPE criteria) 22
cpe:2.3:a:google:chrome:-:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*cpe:2.3:a:opera:opera_browser:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_rf68xr_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_rf615r_firmware:*:*:*:*:*:*:*:*cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
References 150
- http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/ Third Party Advisory
- http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx Third Party Advisory
- http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx Third Party Advisory
- http://curl.haxx.se/docs/adv_20120124B.html Third Party Advisory
- http://downloads.asterisk.org/pub/security/AST-2016-001.html Third Party Advisory
- http://ekoparty.org/2011/juliano-rizzo.php Broken Link
- http://eprint.iacr.org/2004/111 Third Party Advisory
- http://eprint.iacr.org/2006/136 Third Party Advisory
- http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html Not Applicable, Vendor Advisory
- http://isc.sans.edu/diary/SSL+TLS+part+3+/11635 Third Party Advisory
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html Broken Link
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html Broken Link
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html Broken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html Broken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html Broken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html Broken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html Broken Link, Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Broken Link
- http://marc.info/?l=bugtraq&m=132750579901589&w=2 Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=132872385320240&w=2 Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=133365109612558&w=2 Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=133728004526190&w=2 Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134254866602253&w=2 Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134254957702612&w=2 Issue Tracking, Mailing List, Third Party Advisory
- http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue Third Party Advisory
- http://osvdb.org/74829 Broken Link
- http://rhn.redhat.com/errata/RHSA-2012-0508.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1455.html Broken Link
- http://secunia.com/advisories/45791 Not Applicable
- http://secunia.com/advisories/47998 Not Applicable
- http://secunia.com/advisories/48256 Not Applicable
- http://secunia.com/advisories/48692 Not Applicable
- http://secunia.com/advisories/48915 Not Applicable
- http://secunia.com/advisories/48948 Not Applicable
- http://secunia.com/advisories/49198 Not Applicable
- http://secunia.com/advisories/55322 Not Applicable
- http://secunia.com/advisories/55350 Not Applicable
- http://secunia.com/advisories/55351 Not Applicable
- http://security.gentoo.org/glsa/glsa-201203-02.xml Third Party Advisory
- http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory
- http://support.apple.com/kb/HT4999 Third Party Advisory
- http://support.apple.com/kb/HT5001 Third Party Advisory
- http://support.apple.com/kb/HT5130 Third Party Advisory
- http://support.apple.com/kb/HT5281 Broken Link
- http://support.apple.com/kb/HT5501 Third Party Advisory
- http://support.apple.com/kb/HT6150 Third Party Advisory
- http://technet.microsoft.com/security/advisory/2588513 Patch, Vendor Advisory
- http://vnhacker.blogspot.com/2011/09/beast.html Third Party Advisory
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf Third Party Advisory
- http://www.debian.org/security/2012/dsa-2398 Third Party Advisory
- http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html Broken Link
- http://www.ibm.com/developerworks/java/jdk/alerts/ Third Party Advisory
- http://www.imperialviolet.org/2011/09/23/chromeandbeast.html Third Party Advisory
- http://www.insecure.cl/Beast-SSL.rar Broken Link, Patch
- http://www.kb.cert.org/vuls/id/864643 Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:058 Broken Link
- http://www.opera.com/docs/changelogs/mac/1151/ Third Party Advisory