Input validation error - CVE-2011-3389

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33689

Input validation error - CVE-2011-3389

Published: September 6, 2011 / Updated: August 4, 2020


Vulnerability identifier: #VU33689
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-3389
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.


Affected software

WebSphere Message Broker Toolkit
HP System Management Homepage
WebSphere Message Broker
Integration Toolkit
IBM Integration Bus
IBM BladeCenter Advanced Management Module
Fedora
IBM Flex System Manager
Flex System Chassis Management Module (CMM)
Flex System Integrated Management Module (IMM2)
System x Integrated Management Module (IMM2)
IBM Storwize V3500
IBM Storwize V3700
IBM Storwize V5000
IBM Storwize V7000
python26
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)

How to mitigate CVE-2011-3389

Install update from vendor's website.

IBM Flex System Manager - update to 1.3.1
Flex System Chassis Management Module (CMM) - update to 1.50.1F
python26 - update to 2.6.8-1.el5
Flex System Integrated Management Module (IMM2) - update to 3.50
System x Integrated Management Module (IMM2) - update to 3.65
IBM BladeCenter Advanced Management Module - update to 3.66B
EMC ViPR SRM - update to 4.5.0.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.5.0.1
WebSphere Message Broker - addressed in versions 7.0.0.8, 8.0.0.7
IBM Storwize V3500 - update to 7.4.0.0
IBM Storwize V3700 - update to 7.4.0.0
IBM Storwize V5000 - update to 7.4.0.0
IBM Storwize V7000 - update to 7.4.0.0
Integration Toolkit - update to 9.0 Fix Pack 3

External References

Related Security Bulletins