By Jesse Ocean  |   11th November 16

dreamstime_m_92145155-2
By Jesse Ocean November 11 2016

Poodle Vulnerabilities

The Secure Sockets Layer SSL protocol is a cryptographic protocol which allows client-server applications to communicate across a network in a way that is designed to prevent eavesdropping and tampering. The Secure Socket Layer version 3 was adopted when the Secure Socket Layer version 2 was discovered to have multiple serious security flaws but since its adoption, additional security issues have been discovered. POODLE being one of them.
POODLE (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability that allows a man-in-the-middle attacker to decrypt ciphertext using a POODLE attack. The attack exploits a weakness in Cipher Block Chaining (CBC) encryption in SSL in which part of the encrypted data cannot be verified by the receiver when decrypting. The attacker exploits this weakness by replacing part of the encrypted data and forwarding it to the server. In most cases, the server will reject the attacker’s request but the attacker keeps sending the request until the server accepts the request. For a Man-in-the-Middle attack to work, the attacker must first infiltrate the network between the victim and the target. The attacker’s goal in this situation is to retrieve the HTTP session cookie. The attacker then modifies the SSL requests so that the session cookie data is copied to the end of the message.
This vulnerability applies to all implementations of the SSLv3. If your web server does not permit SSL connections and only utilizes TLS (Transport Layer Security), you will not be affected as the connection cannot be downgraded from TLS to SSL if SSL is not available. POODLE affects older standards of encryption, specifically SSLv3. It does not affect the newer encryption mechanism, like the TLS. POODLE has raised concerns in organisations since unlike Heartbleed and Shell Shock, which targeted servers, POODLE targets clients and data on transit over a network a situation that leads to the leakage of sensitive information to the wrong hands.
As an administrator some of the solutions to this vulnerability are:
  • Disabling SSLv3 wherever possible
  • Apply patches and updates from vendors, especially in cases where the SSLv3 cannot be disabled.
  • Deploying support for TLS Signalling Cipher Suite Value (SCSV). SCSV prevents downgrading or fall-back attacks to SSLv3 or earlier versions in case of a man-in-the-middle attack.
  • Disabling SSLv3 completely on both the server side and client side is the only sure way to deal with Man-in-the-middle attacks although doing so might cause problems to clients using SSLv3 on their browsers when accessing the servers.
Connect-With-Us---Jesse-Image
Jesse Ocean / About Author
Jesse Ocean is Ooze Studios' Founder & Managing Director. Together with the Ooze team, he's been helping B2B and B2C clients grow through rigorous ROI strategies.
More posts by Jesse Ocean

Leave a comment