Original Publication Date: 17 October, 2014
Affected Cyberoam Versions: All Versions
a. Hotfix Availability
Cyberoam has released the hotfix for the listed CyberoamOS versions on November 10, 2014:
b. IPS Signature
To mitigate the POODLE vulnerability, Cyberoam has released IPS Version 3.11.92/5.11.92 containing the following IPS signatures:
· SSLv3.0 ServerHello from vulnerable server - CVE-2014-3566
· SSLv3.0 ClientHello from vulnerable client - CVE-2014-3566
· SSLv3.0 ChangeCipherSpec message - CVE-2014-3566
· Excessive fatal alerts - possible CVE-2014-3566 attack against client
Cyberoam recommends implementing the following security measure for Clients and Servers using the affected SSL version:
For Clients and Browsers:
Internet Explorer users need to go to Internet Options, click Advanced tab and uncheck SSLv3 for disabling SSL 3.0.
For protecting the servers, it is recommended to verify the SSL version used on the server and disable or apply patch for respective server.
17 October, 2014
Initial public release containing information on the vulnerability and security recommendations.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.