This document describes the support position of Sustaining Engineering relative to a Trellix application.
Overview
This document addresses concerns about ePO and the Blockwise Chosen-Boundary Attack (BCBA) vulnerability, which allows man-in-the-middle attacks through plaintext HTTP headers.
CVE-2011-3389
Description
The Secure Socket Layer protocol as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other browsers, encrypts data by using Cipher-Block Chaining mode with chained initialization vectors. This allows man-in-the-middle attackers to obtain plaintext HTTP headers using a BCBA on an HTTPS session. This is in conjunction with JavaScript code that uses one of the following:
- HTML5 WebSocket API
- Java URLConnection API
- Silverlight WebClient API (also known as a "BEAST" attack)
The ePO server doesn't use any of the three items above in a way that would allow this vulnerability to be successful. Therefore, this vulnerability isn't an issue.
Research and Conclusions
This issue doesn't affect ePO.
Disclaimer
Any future product release dates mentioned in this statement are intended to outline our general product direction and shouldn't be relied on in making a purchasing decision:
- The product release dates are for information purposes only, and may not be incorporated into any contract.
- The product release dates aren't a commitment, promise, or legal obligation to deliver any material, code, or functionality.
- The development, release, and timing of any features or functionality described for our products remains at our sole discretion and may be changed or canceled at any time.
