On September 23rd, 2011, a research paper was published at a security conference regarding an attack on the SSLv3/TLS 1.0 protocol. Up until recently this attack was only theoretical.
MITRE CVE-2011-3389 describes the issue as follows:
Problem or Goal:
For this attack to be carried out there are many requirements that need to fall into place. The attack in nature is difficult to exploit due to these requirements. For example, the attacker will need to be able to intercept all client network traffic as well as predict which HTTPS site the user will go to in the future.
The following article describes the requirements for this attack to take place:
Juniper Networks is well aware of the reported issue and is investigating backward-compatible alternatives that will help mitigate the issue. Refer to the following table for information that has been provided by several major web browser vendors:
Note: Juniper is supplying these URLs for reference only. We do not guarantee nor have directly verified the validity of statements made by third parties.
By switching to RC4 based encryption, the issue can be completely avoided. This is because the vulnerability exists only with encryption methods that use CBC (Cipher-Block Chaining). RC4 is a stream based cipher; so it does not have this issue.
Note: RC4 is cryptographically less secure than AES or 3DES.
In particular, OpenSSL versions 0.9.6d or later (found in Junos 11.1R1 or ater) implement a feature, in which an empty TLS record is sent immediately, before sending a message. This empty TLS record causes a change in the CBC state, as in it triggers the a new IV message, which the attacker cannot predict. In OpenSSL versions 0.9.6d or later, by default, this protocol-level mitigation is enabled; which makes the Junos OS invulnerable to the BEAST attack.