This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

New SSL vulnerability "Poodle" and the Userportal

Hi all,

I just found out about poodle and tested my UTM for it: It sure is vulnerable... and of course the Userportal is exposed. The Webadmin is not available form outside though.

As long as there is no fix from Sophos is it advisable to just disable SSLv3 in the httpd.conf under /var/sec/chroot-httpd/etc/httpd ?, i.e. make the "SSLProtocol all -SSLv2" to a "SSLProtocol all -SSLv2 -SSLv3" like on any other Apache Webserver?

All the best,

maybeageek

Poodle: Google Finds Vulnerability In SSL 3.0 Web Encryption - Slashdot
Test if a server is vulnerable: openssl s_client -connect IPofAPACHE:443 -ssl3

This thread was automatically locked due to age.

0 Revan over 10 years ago

Will SSLv3 be re-enabled in the upcoming patch automatically when i disable SSLv3 like described in kb article 121509?
Cancel
Vote Up 0 Vote Down

Cancel
0 darrellr_01 over 10 years ago

The protocol itself is broken. It should not be re-enabled by the patch.
Cancel
Vote Up 0 Vote Down

Cancel
0 mas0384 over 10 years ago in reply to eserzet_01

If you follow the instructions from KB The SSL v3.0 CBC (Poodle) vulnerability: affected versions, recommended steps and workarounds for disabling SSL3 in Sophos UTM SMTP Proxy Exim, you won't receive Mails from many many SMTPs out there, e.g. google, amazon... They only uses TLS Versions prior 1.2. With the settings from KB article your SOPHOS UTM handles ONLY TLS1.2 requests.

Instead we changed only the option

openssl_options = +no_tlsv1_2

to

openssl_options = +no_sslv3

With this, UTMs SMTP speaks TLS1, TLS1.1, TLS1.2 .

Addition: It is important that you DO NOT add "!SSLv3" to tls_require_ciphers - that's what I meant by "Instead we changed only the option" ... ;-) If you do it regardlessly, UTM SMTP stays on TLSv1.2 only no matter the openssl_options change.

can someone of Sophos-staff please change the infos in Article ID: 121509
not very good if you change 50 firewalls to see that its not working at the end
Cancel
Vote Up 0 Vote Down

Cancel
0 teched_01 over 10 years ago

It appears the KB article has been updated. The SMTP section currently reads:

Sophos UTM
SMTP Proxy
Disable SSLv3 for SMTP and turn TLSv1.2 back on:

Navigate to /var/chroot-smtp/etc/
Open the exim.conf with vi: vi exim.conf
Change the line openssl_options to: openssl_options = +no_sslv3
Save your changes and close the editor: :wq
Now restart the smtpd service by executing /var/mdw/scripts/smtp restart

Unfortunately Sophos doesn't appear to include any change information or notes to revert their prior recommended workaround(s).

I have updated my alternative workarounds (scripts) thread https://www.astaro.org/gateway-products/general-discussion/54160-some-alternative-poodle-workarounds-utm.html.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

Thanks for the confirmation, teched. I emailed one of the Sophos Product Managers yesterday, but I don't know if that was what got the ball moved. Your other thread taught me some new tricks - Thanks!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 ZeusDionysos over 10 years ago in reply to eserzet_01
If you follow the instructions from KB The SSL v3.0 CBC (Poodle) vulnerability: affected versions, recommended steps and workarounds for disabling SSL3 in Sophos UTM SMTP Proxy Exim, you won't receive Mails from many many SMTPs out there, e.g. google, amazon... They only uses TLS Versions prior 1.2. With the settings from KB article your SOPHOS UTM handles ONLY TLS1.2 requests.

Instead we changed only the option

openssl_options = +no_tlsv1_2

to

openssl_options = +no_sslv3

With this, UTMs SMTP speaks TLS1, TLS1.1, TLS1.2 .

Addition: It is important that you DO NOT add "!SSLv3" to tls_require_ciphers - that's what I meant by "Instead we changed only the option" ... ;-) If you do it regardlessly, UTM SMTP stays on TLSv1.2 only no matter the openssl_options change.

In the moment I have a problem which is related to the Poodle Bug I guess...
Our SMTP-Proxy log says the following:

exim-in[4962]: 11:56:03 SMTP connection from [17.151.1.82]:43841 (TCP/IP connection count = 1)
exim-in[12291]: 1:56:04 TLS error on connection from nwk-txn-msbadger0703.apple.com [17.151.1.82]:43841 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
exim-in[12291]: 11:56:04 TLS client disconnected cleanly (rejected our certificate?)
exim-in[12291]: 11:56:04 SMTP connection from nwk-txn-msbadger0703.apple.com [17.151.1.82]:43841 closed by QUIT
exim-in[4962]: 11:56:31 SMTP connection from [209.85.214.199]:60107 (TCP/IP connection count = 1)
exim-in[12302]: 11:56:32 TLS error on connection from mail-ob0-f199.google.com [209.85.214.199]:60107 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
exim-in[12302]: 11:56:32 TLS client disconnected cleanly (rejected our certificate?)
exim-in[12302]: 11:56:32 SMTP connection from mail-ob0-f199.google.com [209.85.214.199]:60107 closed by EOF

We are running Sophos UTM 9.209-8.

Our /var/chroot-smtp/etc/exim.conf says the following about TLS:

# TLS
tls_certificate = ${if eq{TLS_NAME}{} {}{INCLUDE/TLS_NAME.cert}}
tls_privatekey = ${if eq{TLS_NAME}{} {}{INCLUDE/TLS_NAME.key}}
tls_advertise_hosts = ${if eq{TLS_NAME}{} {}{!+tls_avoid}}
#openssl_options = +no_tlsv1_2

I modified in exim.conf the #openssl_options line to the following with no success:
openssl_options = +no_sslv3

Does anyone have the same problem? Does anyone have an Idea how I can fix this problem?

Regards
Chris
Cancel
Vote Up 0 Vote Down

Cancel
0 Microsaft over 10 years ago

@Zeus:

What is at line "tls_require_ciphers"? (...DO NOT add "!SSLv3" to tls_require_ciphers)
Cancel
Vote Up 0 Vote Down

Cancel
0 ZeusDionysos over 10 years ago in reply to Microsaft

@Zeus:

What is at line "tls_require_ciphers"? (...DO NOT add "!SSLv3" to tls_require_ciphers)

tls_require_ciphers = RC4+RSA:HIGH:!MD5:!ADH:!SSLv2:!SSLv3

Do I have to remove the ":!SSLv3" from the line "tls_require_ciphers"?

Is there a method how I can test which method is available?
From an intern ubuntu server I tried the following:
openssl s_client -starttls smtp -crlf -ssl3 -connect :25

Depending on what port I use I get different results.
On port 25 and 587 only tls1.2 works but on port 465 I get an "connected" with ssl3 and tls1.0-1.2.

Edit:
Removed ":!SSLv3" from "tls_require_ciphers" and now "openssl s_client -starttls smtp -crlf -tls1 -connect :25" works with tls1, tls1_1 and tls1_2 for both ports 25 and 587.
Now it looks like it works. ssl-tools.net shows now TLS1, 1.1 and 1.2 [:)]

Edit2:
Recived a testmail from google mail, so I think the problem should now be solved.

Thank you Microsaft for your quick answer and help :-)
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 10 years ago
Today I came across a site giving a CC command on how to disable SSLv3 in the UTM's proxy. It appears that the proxy still accepts SSLv3 traffic even with the latest patches applied (9.209-8).

Right now I have a GPO that kills SSLv3 for IE, Google Chrome has disabled it by default, but firefox will also need to disable it and maybe more browsers will need to be individually adjusted.

A better way would be when the proxy just doesn't allow SSLv3 and this should be possible according to this PDF (on a site unknown to me):

http://blog.shabakeh.net/wp-content/uploads/2014/10/POODLE-Sophos.pdf

Before I just start putting those commands in the shell, I would like to know if anyone else can say that this is indeed safe, or knows of any other way to just hold SSLv3 traffic at the perimeter in stead of at every inidividual browser.
Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago in reply to apijnappels

It appears that the proxy still accepts SSLv3 traffic even with the latest patches applied (9.209-8).

Hi, have you reported this to your reseller and/or Sophos?

Barry
Cancel
Vote Up 0 Vote Down

Cancel