POODLE attack exploiting SSL 3.0 fallback

[sajugovind]

A CVE-2014-3566 vulnerability in SSLv3 protocol was identified by the Google security team. There is an additional whitepaper available from OpenSSL that also describes this vulnerability.

You can check if your website is vulnerable with curl:

Code: [Select]

curl -v3 -X HEAD https://www.example.com
If you are NOT vulnerable, your output should look something like this:

Code: [Select]

curl: (35) SSL connect error

Code: [Select]

If you ARE vulnerable, you will see normal connection outputs, potentially including the line:

SSL 3.0 connection using ...
Resolution:

Although the possibility to exploit this vulnerability is quite low, the simplest way is to disable SSL 3.0 - this obsoleted protocol version is being used for compatibility needs and is not required for Parallels products.


Thank you,