NVD

Id
21679  
Name
CVE-2016-7152  
Description
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-09-06  
Modified Date
2016-11-28  
Seq
2016-7152  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
116556 21679 CVE-2016-7152 http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/  View
116557 21679 CVE-2016-7152 92769  View
116558 21679 CVE-2016-7152 1036741  View
116559 21679 CVE-2016-7152 1036742  View
116560 21679 CVE-2016-7152 1036743  View
116561 21679 CVE-2016-7152 1036744  View
116562 21679 CVE-2016-7152 1036745  View
116563 21679 CVE-2016-7152 1036746  View
116564 21679 CVE-2016-7152 https://tom.vg/papers/heist_blackhat2016.pdf  View
116565 21679 CVE-2016-7152 https://www.blackhat.com/docs/us-16/materials/us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows-wp.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3761 JVNDB-2016-004534 HTTPS プロトコルにおける平文データを取得される脆弱性 HTTPS プロトコルは、コンテンツの長さに関する情報を提供する際の TCP Congestion Window の役割を考慮しないため、平文データを取得される脆弱性が存在します。 CVE-2016-7152 93659 CVE-2016-7152 21679 5 5.3 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004534.html 2016-08-04 2016-09-07 View