On September 23rd, 2011, a research paper was published at a security conference regarding an attack on the SSLv3/TLS 1.0 protocol. Up until recently this attack was only theoretical.
MITRE CVE-2011-3389 describes the issue as follows:
Problem or Goal:
The BEAST issue is a vulnerbility on the client side (web browser). For this attack to be carried out there are many requirements that need to fall into place. The attack in nature is difficult to exploit due to these requirements. For example, the attacker will need to be able to intercept all client network traffic as well as predict which HTTPS site the user will go to in the future.
We recommend using AES/3DES at this time, but only if the clients are using a fixed browser (see browser table above).
Note: Previously RC4 was the recommended cipher to mitigate the BEAST issue. This recommendation has changed since most major browsers have fixes in place for the issue. If you are unable to use a browser that contains a fix for BEAST, RC4 would still be the best cipher to choose until you can upgrade your browser.
In particular, OpenSSL versions 0.9.6d or later (found in Junos 11.1R1 or ater) implement a feature, in which an empty TLS record is sent immediately, before sending a message. This empty TLS record causes a change in the CBC state, as in it triggers the a new IV message, which the attacker cannot predict. In OpenSSL versions 0.9.6d or later, by default, this protocol-level mitigation is enabled; which makes the Junos OS invulnerable to the BEAST attack.
Customer should switch from 3DES to RC4 encryption to avoid the vulnerability.