HTTP: Beast WebSocket Initialization

This signature detects the initialization of the WebSocket protocol which may be an indication of an attack. This protocol has been used in a variety of man in the middle exploitation's involving the SSL protocol and also a key component in the BEAST TLS/SSL exploitation tool. An attacker who exploits this vulnerability could gain access to a victim's sensitive information. This signature could trigger false positives if legitimate uses of the WebSocket protocol is used.

Extended Description

Multiple vendors' TLS protocol implementations are prone to a security vulnerability related to the session-renegotiation process. Successful exploits of this issue may allow attackers to perform limited man-in-the-middle attacks against vulnerable applications. Note that this issue does not allow attackers to decrypt encrypted data.

Affected Products

Cisco wireless_lan_control,Sun java_system_web_server,Opera_software opera_web_browser

References

BugTraq: 36935

CVE: CVE-2011-3389

URL: http://www.eweek.com/c/a/Security/Researchers-Claim-Attack-Tool-Can-Crack-Encrypted-Web-Traffic-222593/

Short Name

HTTP:STC:JAVA:BEAST-WEBSOCKET

Severity

Major

Recommended

False

Recommended Action

None

HTTP: Beast WebSocket Initialization

Extended Description

Affected Products

References

Found a potential security threat?