Description
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | oxide-qt | No fix yet | — |
References
- 1036741 vdb-entry
- 1036742 vdb-entry
- 92769 vdb-entry
- https://tom.vg/papers/heist_blackhat2016.pdf
- 1036745 vdb-entry
- http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/
- 1036744 vdb-entry
- 1036743 vdb-entry
- 1036746 vdb-entry