Get your server issues fixed by our experts for a price starting at just 25 USD/Hour. Click here to register and open a ticket with us now!

Author Topic: POODLE attack exploiting SSL 3.0 fallback  (Read 3787 times)

0 Members and 1 Guest are viewing this topic.

sajugovind

  • Guest
POODLE attack exploiting SSL 3.0 fallback
« on: October 20, 2014, 11:22:30 pm »
A CVE-2014-3566 vulnerability in SSLv3 protocol was identified by the Google security team. There is an additional whitepaper available from OpenSSL that also describes this vulnerability.

You can check if your website is vulnerable with curl:

Code: [Select]
curl -v3 -X HEAD https://www.example.com
If you are NOT vulnerable, your output should look something like this:

Code: [Select]
curl: (35) SSL connect error
Code: [Select]
If you ARE vulnerable, you will see normal connection outputs, potentially including the line:

SSL 3.0 connection using ...

Resolution:

Although the possibility to exploit this vulnerability is quite low, the simplest way is to disable SSL 3.0 - this obsoleted protocol version is being used for compatibility needs and is not required for Parallels products.


Thank you,