Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 33 replies
  • Subscribers 4 subscribers
  • Views 87158 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

New SSL vulnerability "Poodle" and the Userportal

maybeageek
Hi all,

I just found out about poodle and tested my UTM for it: It sure is vulnerable... and of course the Userportal is exposed. The Webadmin is not available form outside though.

As long as there is no fix from Sophos is it advisable to just disable SSLv3 in the httpd.conf under /var/sec/chroot-httpd/etc/httpd ?, i.e. make the "SSLProtocol all -SSLv2" to a "SSLProtocol all -SSLv2 -SSLv3" like on any other Apache Webserver?

All the best,

maybeageek

Poodle: Google Finds Vulnerability In SSL 3.0 Web Encryption - Slashdot
Test if a server is vulnerable: openssl s_client -connect IPofAPACHE:443 -ssl3


This thread was automatically locked due to age.
Parents
  • 0
    Darrell, if people have "Any" in 'Allowed networks' for WebAdmin or 'Shell Access', that's a bigger problem than Poodle.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    Darrell, if people have "Any" in 'Allowed networks' for WebAdmin or 'Shell Access', that's a bigger problem than Poodle.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson
    Darrell, if people have "Any" in 'Allowed networks' for WebAdmin or 'Shell Access', that's a bigger problem than Poodle.

    Cheers - Bob


    The UserPortal would be included in the WebAdmin side for public access.  I agree about the webadmin side, but test it yourself.  make the changes listed first, and you will still be flagged for the user portal ports from the WAN side.  Make the change I suggested and the UserPortal will be protected as well.

    EDIT:  Or are you saying you should not publish the UserPortal to the WAN side?
Unfiltered HTML