This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

New SSL vulnerability "Poodle" and the Userportal

Hi all,

I just found out about poodle and tested my UTM for it: It sure is vulnerable... and of course the Userportal is exposed. The Webadmin is not available form outside though.

As long as there is no fix from Sophos is it advisable to just disable SSLv3 in the httpd.conf under /var/sec/chroot-httpd/etc/httpd ?, i.e. make the "SSLProtocol all -SSLv2" to a "SSLProtocol all -SSLv2 -SSLv3" like on any other Apache Webserver?

All the best,

maybeageek

Poodle: Google Finds Vulnerability In SSL 3.0 Web Encryption - Slashdot
Test if a server is vulnerable: openssl s_client -connect IPofAPACHE:443 -ssl3

This thread was automatically locked due to age.

Parents

0 dschmidl over 10 years ago

Hi Folks,

please check out SSL v3.0 CBC vulnerability (poodle): affected versions, recommended steps and Workarounds for more information.

Regards
Dominic
Cancel
Vote Up 0 Vote Down

Cancel
0 maybeageek over 10 years ago in reply to dschmidl

Hi Folks,

please check out SSL v3.0 CBC vulnerability (poodle): affected versions, recommended steps and Workarounds for more information.

Regards
Dominic

Thank you. This question is probably redundant to your link (which I read) but: Is SSL-VPN affected in any way or does Sophos not use SSLv3 for SSLVPN?

Thank you!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 maybeageek over 10 years ago in reply to dschmidl

Hi Folks,

please check out SSL v3.0 CBC vulnerability (poodle): affected versions, recommended steps and Workarounds for more information.

Regards
Dominic

Thank you. This question is probably redundant to your link (which I read) but: Is SSL-VPN affected in any way or does Sophos not use SSLv3 for SSLVPN?

Thank you!
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 dschmidl over 10 years ago in reply to maybeageek

Hello,

SSL VPN is not vulnerable in the UTM.

Regards
Dominic

P.S.: POODLE attack takes bytes out of your encrypted data – here’s what to do | Naked Security is also worth to look at for good summary of the problem.
Cancel
Vote Up 0 Vote Down

Cancel