This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

New SSL vulnerability "Poodle" and the Userportal

Hi all,

I just found out about poodle and tested my UTM for it: It sure is vulnerable... and of course the Userportal is exposed. The Webadmin is not available form outside though.

As long as there is no fix from Sophos is it advisable to just disable SSLv3 in the httpd.conf under /var/sec/chroot-httpd/etc/httpd ?, i.e. make the "SSLProtocol all -SSLv2" to a "SSLProtocol all -SSLv2 -SSLv3" like on any other Apache Webserver?

All the best,

maybeageek

Poodle: Google Finds Vulnerability In SSL 3.0 Web Encryption - Slashdot
Test if a server is vulnerable: openssl s_client -connect IPofAPACHE:443 -ssl3

This thread was automatically locked due to age.

Parents

0 eserzet_01 over 10 years ago

If you follow the instructions from KB The SSL v3.0 CBC (Poodle) vulnerability: affected versions, recommended steps and workarounds for disabling SSL3 in Sophos UTM SMTP Proxy Exim, you won't receive Mails from many many SMTPs out there, e.g. google, amazon... They only uses TLS Versions prior 1.2. With the settings from KB article your SOPHOS UTM handles ONLY TLS1.2 requests.

Instead we changed only the option

openssl_options = +no_tlsv1_2

to

openssl_options = +no_sslv3

With this, UTMs SMTP speaks TLS1, TLS1.1, TLS1.2 .

Addition: It is important that you DO NOT add "!SSLv3" to tls_require_ciphers - that's what I meant by "Instead we changed only the option" ... ;-) If you do it regardlessly, UTM SMTP stays on TLSv1.2 only no matter the openssl_options change.
Cancel
Vote Up 0 Vote Down

Cancel
0 ZeusDionysos over 10 years ago in reply to eserzet_01
If you follow the instructions from KB The SSL v3.0 CBC (Poodle) vulnerability: affected versions, recommended steps and workarounds for disabling SSL3 in Sophos UTM SMTP Proxy Exim, you won't receive Mails from many many SMTPs out there, e.g. google, amazon... They only uses TLS Versions prior 1.2. With the settings from KB article your SOPHOS UTM handles ONLY TLS1.2 requests.

Instead we changed only the option

openssl_options = +no_tlsv1_2

to

openssl_options = +no_sslv3

With this, UTMs SMTP speaks TLS1, TLS1.1, TLS1.2 .

Addition: It is important that you DO NOT add "!SSLv3" to tls_require_ciphers - that's what I meant by "Instead we changed only the option" ... ;-) If you do it regardlessly, UTM SMTP stays on TLSv1.2 only no matter the openssl_options change.

In the moment I have a problem which is related to the Poodle Bug I guess...
Our SMTP-Proxy log says the following:

exim-in[4962]: 11:56:03 SMTP connection from [17.151.1.82]:43841 (TCP/IP connection count = 1)
exim-in[12291]: 1:56:04 TLS error on connection from nwk-txn-msbadger0703.apple.com [17.151.1.82]:43841 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
exim-in[12291]: 11:56:04 TLS client disconnected cleanly (rejected our certificate?)
exim-in[12291]: 11:56:04 SMTP connection from nwk-txn-msbadger0703.apple.com [17.151.1.82]:43841 closed by QUIT
exim-in[4962]: 11:56:31 SMTP connection from [209.85.214.199]:60107 (TCP/IP connection count = 1)
exim-in[12302]: 11:56:32 TLS error on connection from mail-ob0-f199.google.com [209.85.214.199]:60107 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
exim-in[12302]: 11:56:32 TLS client disconnected cleanly (rejected our certificate?)
exim-in[12302]: 11:56:32 SMTP connection from mail-ob0-f199.google.com [209.85.214.199]:60107 closed by EOF

We are running Sophos UTM 9.209-8.

Our /var/chroot-smtp/etc/exim.conf says the following about TLS:

# TLS
tls_certificate = ${if eq{TLS_NAME}{} {}{INCLUDE/TLS_NAME.cert}}
tls_privatekey = ${if eq{TLS_NAME}{} {}{INCLUDE/TLS_NAME.key}}
tls_advertise_hosts = ${if eq{TLS_NAME}{} {}{!+tls_avoid}}
#openssl_options = +no_tlsv1_2

I modified in exim.conf the #openssl_options line to the following with no success:
openssl_options = +no_sslv3

Does anyone have the same problem? Does anyone have an Idea how I can fix this problem?

Regards
Chris
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ZeusDionysos over 10 years ago in reply to eserzet_01
If you follow the instructions from KB The SSL v3.0 CBC (Poodle) vulnerability: affected versions, recommended steps and workarounds for disabling SSL3 in Sophos UTM SMTP Proxy Exim, you won't receive Mails from many many SMTPs out there, e.g. google, amazon... They only uses TLS Versions prior 1.2. With the settings from KB article your SOPHOS UTM handles ONLY TLS1.2 requests.

Instead we changed only the option

openssl_options = +no_tlsv1_2

to

openssl_options = +no_sslv3

With this, UTMs SMTP speaks TLS1, TLS1.1, TLS1.2 .

Addition: It is important that you DO NOT add "!SSLv3" to tls_require_ciphers - that's what I meant by "Instead we changed only the option" ... ;-) If you do it regardlessly, UTM SMTP stays on TLSv1.2 only no matter the openssl_options change.

In the moment I have a problem which is related to the Poodle Bug I guess...
Our SMTP-Proxy log says the following:

exim-in[4962]: 11:56:03 SMTP connection from [17.151.1.82]:43841 (TCP/IP connection count = 1)
exim-in[12291]: 1:56:04 TLS error on connection from nwk-txn-msbadger0703.apple.com [17.151.1.82]:43841 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
exim-in[12291]: 11:56:04 TLS client disconnected cleanly (rejected our certificate?)
exim-in[12291]: 11:56:04 SMTP connection from nwk-txn-msbadger0703.apple.com [17.151.1.82]:43841 closed by QUIT
exim-in[4962]: 11:56:31 SMTP connection from [209.85.214.199]:60107 (TCP/IP connection count = 1)
exim-in[12302]: 11:56:32 TLS error on connection from mail-ob0-f199.google.com [209.85.214.199]:60107 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
exim-in[12302]: 11:56:32 TLS client disconnected cleanly (rejected our certificate?)
exim-in[12302]: 11:56:32 SMTP connection from mail-ob0-f199.google.com [209.85.214.199]:60107 closed by EOF

We are running Sophos UTM 9.209-8.

Our /var/chroot-smtp/etc/exim.conf says the following about TLS:

# TLS
tls_certificate = ${if eq{TLS_NAME}{} {}{INCLUDE/TLS_NAME.cert}}
tls_privatekey = ${if eq{TLS_NAME}{} {}{INCLUDE/TLS_NAME.key}}
tls_advertise_hosts = ${if eq{TLS_NAME}{} {}{!+tls_avoid}}
#openssl_options = +no_tlsv1_2

I modified in exim.conf the #openssl_options line to the following with no success:
openssl_options = +no_sslv3

Does anyone have the same problem? Does anyone have an Idea how I can fix this problem?

Regards
Chris
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data