{"id":2401,"date":"2014-10-22T05:34:51","date_gmt":"2014-10-22T09:34:51","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=1611"},"modified":"2023-04-07T17:28:59","modified_gmt":"2023-04-07T21:28:59","slug":"ssl3-poodle-vulnerability","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/ssl3-poodle-vulnerability\/","title":{"rendered":"SSL 3.0 POODLE Vulnerability Has Wide Ranging Effects"},"content":{"rendered":"

What is \u201cPOODLE\u201d? <\/strong><\/h2>\n

POODLE is an acronym for a newly discovered vulnerability in a specific version of the SSL protocol. POODLE requires an \u201cactive\u201d attacker, meaning there must be another \u2018bad\u2019 computer intercepting messages between the client and server. Ultimately, the vulnerability allows the attacker to decode messages encrypted with SSL v3.0 (the specific, and only, version of the protocol affected).<\/p>\n

SSL v3.0 is an old version of the SSL protocol, a very old version – from the late 90s. However, almost all servers on the Internet still accept connections using it. Luckily, there is a straightforward way to protect yourself from this attack (see \u201cAs An SSL Provider, What Should I Do?\u201d section below). The attack also is fairly complex to perform, because of its reliance on being an \u201cactive\u201d attack which affects the client. There are also no known attacks using the POODLE vulnerability (yet). For this reason, it is much less serious than the Heartbleed vulnerability from earlier this year. Security expert Robert Graham said, \u201cIf Hearbleed\/Shellshock merited a 10, then this attack is only around a 5.\u201d1<\/a><\/sup><\/p>\n

However, this does not mean that POODLE should be ignored, because all servers or clients running SSL v3.0 are vulnerable. (See section, \u201cWho is Affected?\u201d for specific details on this and threat analysis).<\/p>\n

The vulnerability is serious enough that Mozilla has declared POODLE “the end of SSL 3.0,”2<\/a><\/sup> and Google said “to achieve secure encryption, SSL 3.0 must be avoided entirely.\u201d3<\/a><\/sup><\/p>\n

Please note that (luckily) this is a flaw in an outdated version of the SSL protocol itself, so no changes to any existing certificates themselves are needed. This vulnerability is the result of some bad math back when this version of the protocol was created back in the late 90s.<\/p>\n

Solutions to this vulnerability are most effectively implemented at the server level (even though the attack is on the client, its reliant on the server allowing a connection using SSL v3.0 to occur), so education and awareness of the issue is the best way to mitigate the effects of the POODLE vulnerability.<\/p>\n

How does the Attack Work? <\/strong><\/h2>\n

The POODLE vulnerability can be implemented by an attacker who has control or influence over the network connection between the client and the server \u2013 often called a \u201cMan in the Middle Attack\u201d (MITM).4<\/a><\/sup><\/p>\n

An attack using POODLE begins with a \u201cdowngrade attack\u201d to repeatedly cause the client\u2019s connection to the server to fail. This causes the server to allow an encrypted connection with older versions of the protocol, because it believes a lack of modern protocol support is the cause. This downgrading continues to occur until the connection is downgraded all the way to SSL v3.0, at which point the POODLE attack<\/a> can be used.5<\/a><\/sup><\/p>\n

This downgrade attack works because, while almost every server supports a newer version of the SSL protocol which are not affected, they ALSO support SSL v3.0 in order to avoid any incompatibility issues with older (\u201clegacy\u201d) clients. After forcing stronger clients to downgrade to SSL v3.0, they can use a flaw in the protocol to figure out the encryption key for an SSL connection, and read the contents as if they were unencrypted.<\/p>\n

If you would like to know more about how the attack works, Google provides some excellent information in their paper which announced the discovery: \u201cThis POODLE Bites: Exploiting The SSL 3.0 Fallback.\u201d6<\/a><\/sup><\/p>\n

Who is Affected? <\/strong><\/h2>\n

Any browser or server which supports SSL 3.0 can be victim to POODLE.<\/strong> Critically, \u201cany website that supports SSLv3 is vulnerable to POODLE, even if it also supports more recent versions of TLS.\u201d7<\/a><\/sup> This means that sites trying to provide backwards compatibility for older clients are at risk. For this reason, supporting SSL v3.0 at all can make a server or client vulnerable.<\/p>\n

SSL Pulse is a website that collects monthly demographic statistics of SSL support of the 150,000 most popular websites.8<\/a><\/sup> SSL Pulse\u2019s most recent scan, conducted before the disclosure of the POODLE vulnerability, found that 98% of these sites still have SSL v3.0 support, potentially putting them at risk of a POODLE attack. Extrapolating from this, it can be assumed most servers on the Internet still include support for the decrepit SSL v3.0.<\/p>\n

However, there is very little client traffic still using SSL v3.0 to justify support of this deprecated and flawed protocol version. The most notable software affected by this attack is Internet Explorer 6 on Windows XP versions WITHOUT Service Pack 3.<\/p>\n

Support for this flawed protocol version should not be kept for users still on IE6. On Cloudflare, a major provider of DDoS protection, only 0.65% of their received SSL traffic uses (not relies on) SSL v3.0, and 98% of their Windows XP traffic is properly patched to Service Pack 3 which enables TLS 1.0 (the next version of the SSL protocol after SSL v3.0).9<\/a><\/sup> Mozilla similarly estimates only 0.3% of traffic actually uses SSL v3.0, yet around 98% of servers allow it! The number of clients still needing SSL v3.0 simply does not justify keeping it on.<\/p>\n

As an SSL provider, what should I do? <\/strong><\/h2>\n

The SSL Store\u2019s recommendation is to totally disable support for SSL v3.0. This should be disabled on your servers and communicated to your customers. There are solutions to the POODLE attack, mainly the new protocol mechanism \u201cTLS_FALLBACK_SCSV.\u201d10<\/a><\/sup> However, this mechanism relies on server and browser compatibility, which introduces too much uncertainty to its effectiveness. TLS FALLBACK also does not fix the issue for devices that ONLY have SSL v3.0 support, leaving the biggest vulnerable software – IE6, still exposed.<\/p>\n

So, to be totally safe from POODLE, and other discovered and undiscovered flaws in SSL v3.0, its best to disable support for it altogether at the server side. This falls in line with what is recommended by Google, Mozilla, Cloudflare11<\/a><\/sup>, and other major technology companies.<\/p>\n

On the client side, Firefox will be disabling SSL v3.0 by default in Firefox 34, which is to be released on Nov 25th. Google will also be removing SSL v3.0 support in client devices, including Chrome, \u201cin [the] coming months.\u201d12<\/a><\/sup> With this pressure on the client-side removing SSL v3.0 support, the tiny number of client\u2019s using SSL v3.0 should tumble even further.<\/p>\n

(Also note, if you recently switched to SHA2 certificates, as the SSL industry is encouraging and requiring, you have downgraded the user experience for sluggish clients still on IE6 with Windows XP pre-Service Pack 3. So disabling SSL v3.0 will be the nail in the coffin for them – thats a good thing.)<\/p>\n

Does this mean SSL is insecure? <\/strong><\/h2>\n

No. SSL, or more accurately, TLS, is fine. While most people use the word \u201cSSL\u201d still, the proper technical term for the encryption protocol we use today is TLS. This stands for Transport Layer Security and has been the official name of the SSL protocol since 1999. The newest version of the TLS protocol, Version 1.2, was released in 2008 and is four versions senior of SSL 3.0. All \u2018modern\u2019 browsers and computers, and smartphones should have support for some version of TLS, and the majority of SSL connections are using TLS. TLS 1.0 and 1.1 are not perfect, but they are much improved over SSL v3.0 and are considered suitable by security experts.<\/p>\n

SSL v3.0 is over 15 years old! So it\u2019s only reasonable for it to be abandoned at this point.<\/p>\n<\/span><\/span>\n

How Do I Disable SSL v3.0 on my Server?<\/h2>\n

This depends on the type of server you are operating.<\/p>\n

For Apache Tomcat: https:\/\/bz.apache.org\/bugzilla\/show_bug.cgi?id=54691<\/a><\/p>\n

For Apache, Nginx, and IIS: https:\/\/scotthelme.co.uk\/sslv3-goes-to-the-dogs-poodle-kills-off-protocol\/<\/a><\/p>\n

For Lighttpd: https:\/\/cipherli.st\/ <\/a><\/p>\n

If you do not want to drop SSL v3.0 support, you can implement TLS_FALLBACK_SCSV on OpenSSL. However this should just be a stopgap solution and replacements for devices requiring SSL v3.0 should be actively pursued. https:\/\/www.openssl.org\/news\/secadv_20141015.txt<\/a><\/p>\n

Quayls\u2019 well-known SSL configuration checker tool has been updated to test for POODLE. You can input your websites URL to have it test for POODLE vulnerability: https:\/\/www.ssllabs.com\/ssltest\/ <\/a><\/p>\n

Further Resources: <\/strong><\/h2>\n

In addition to the citations on this resource, please see:<\/p>\n

For technical details on how the vulnerability works, see Google\u2019s original paper: https:\/\/security.googleblog.com\/2014\/10\/this-poodle-bites-exploiting-ssl-30.html<\/a><\/p>\n

For the single best understanding of POODLE and what it means as a Internet user concerned with security, or a server operator, see Robert Graham\u2019s notes on POODLE at his personal website: https:\/\/blog.erratasec.com\/2014\/10\/some-poodle-notes.html <\/a><\/p>\n

Microsoft\u2019s Security Advisory on POODLE: https:\/\/docs.microsoft.com\/en-us\/security-updates\/SecurityAdvisories\/2015\/3009008 <\/a><\/p>\n

\n
\n
    \n
  1. http:\/\/blog.erratasec.com\/2014\/10\/some-poodle-notes.html#.VEWwk4t4p1-<\/a><\/a><\/li>\n
  2. https:\/\/blog.mozilla.org\/security\/2014\/10\/14\/the-poodle-attack-and-the-end-of-ssl-3-0\/<\/a><\/a><\/li>\n
  3. https:\/\/www.openssl.org\/~bodo\/ssl-poodle.pdf<\/a><\/a><\/li>\n
  4. http:\/\/blog.erratasec.com\/2014\/10\/some-poodle-notes.html#.VEUcTvnF-MJ<\/a><\/a><\/li>\n
  5. http:\/\/blog.cryptographyengineering.com\/2014\/10\/attack-of-week-poodle.html<\/a><\/a><\/li>\n
  6. <\/a>Also see Adam Langley\u2019s slightly different explanation on his personal site: https:\/\/www.imperialviolet.org\/2014\/10\/14\/poodle.html<\/a><\/li>\n
  7. <\/a>Section: \u201cIssue\u201d https:\/\/blog.mozilla.org\/security\/2014\/10\/14\/the-poodle-attack-and-the-end-of-ssl-3-0\/<\/a><\/li>\n
  8. <\/a>https:\/\/www.ssllabs.com\/ssl-pulse\/<\/a><\/li>\n
  9. <\/a>https:\/\/blog.cloudflare.com\/sslv3-support-disabled-by-default-due-to-vulnerability\/<\/a><\/li>\n
  10. <\/a>https:\/\/tools.ietf.org\/html\/draft-ietf-tls-downgrade-scsv-00<\/a><\/li>\n
  11. <\/a>https:\/\/blog.cloudflare.com\/sslv3-support-disabled-by-default-due-to-vulnerability\/<\/a><\/li>\n
  12. <\/a>https:\/\/security.googleblog.com\/2014\/10\/this-poodle-bites-exploiting-ssl-30.html<\/a><\/li>\n<\/ol>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    What is \u201cPOODLE\u201d? POODLE is an acronym for a newly discovered vulnerability in a specific version of the SSL protocol. POODLE requires an \u201cactive\u201d attacker, meaning there must be another…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[25],"tags":[],"class_list":["post-2401","post","type-post","status-publish","format-standard","hentry","category-ssl-certificates","post-without-tags"],"views":14351,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=2401"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2401\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=2401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=2401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=2401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}