CURL-CVE-2011-3389

Source

https://curl.se/docs/CVE-2011-3389.html

Import Source

https://curl.se/docs/CURL-CVE-2011-3389.json

Aliases

• CVE-2011-3389
• PSF-2011-3

Published

2012-01-24T08:00:00Z

Modified

2024-01-25T02:42:39.979518Z

Summary

SSL CBC IV vulnerability

Details

curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

This vulnerability has been identified (CVE-2011-3389 aka the "BEAST" attack) and is addressed by OpenSSL already as they have made a work-around to mitigate the problem. When doing so, they figured out that some servers didn't work with the work-around and offered a way to disable it.

The bit used to disable the workaround was then added to the generic SSL_OP_ALL bitmask that SSL clients may use to enable workarounds for better compatibility with servers. libcurl uses the SSLOPALL bitmask.

While SSL_OP_ALL is documented to enable "rather harmless" workarounds, it does in this case effectively enable this security vulnerability again.

References