Major flaw in outdated but widely-used SSL protocol ( POODLE )

Discussion in 'other security issues & news' started by MrBrian, Oct 14, 2014.

Page 1 of 2
  1. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    MrBrian, Oct 14, 2014
    #1
  2. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,102
    Location:
    Texas
    ronjor, Oct 15, 2014
    #2
  3. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,102
    Location:
    Texas
    ronjor, Oct 15, 2014
    #3
  4. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,102
    Location:
    Texas
    http://betanews.com/2014/10/15/mozi...ne-to-poodle-releases-fix-for-older-versions/
     
    ronjor, Oct 15, 2014
    #4
  5. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,430
    Location:
    Surrey, England.
    http://www.wired.com/2014/10/poodle-explained/

    SSL 3.0 vulnerability discovered. Find out how to protect yourself
     
    Last edited: Oct 15, 2014
    Dermot7, Oct 15, 2014
    #5
  6. hawki

    hawki Registered Member

    Joined:
    Dec 17, 2008
    Posts:
    6,077
    Location:
    DC Metro Area
    hawki, Oct 15, 2014
    #6
  7. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    To disable SSL 3.0 protocol in Firefox, do either of these:
    1. Use Mozilla's extension SSL Version Control.
    2. Manual method: Set about:config setting security.tls.version.min = 1 .
     
    MrBrian, Oct 15, 2014
    #7
  8. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,102
    Location:
    Texas
    ronjor, Oct 15, 2014
    #8
  9. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    6,220
    Location:
    USA
    This workaround involves Group Policy Editor. For those using versions of Windows that don't include GPE simply go to Control Panel/Internet Options/Advanced/Security and uncheck the box for SSL 3.0 (SSL 2.0 should already be unchecked).
     
    Victek, Oct 15, 2014
    #9
  10. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,644
    Location:
    USA
    Definitely the easier option. I just got done making that change on about 15 machines.
     
    xxJackxx, Oct 15, 2014
    #10
  11. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    4,873
    Location:
    Outer space
    BoerenkoolMetWorst, Oct 15, 2014
    #11
  12. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    6,220
    Location:
    USA
    The word is Google will be releasing an update for Chrome to disable SSL 3.0, however users can immediately disable it by adding this string to a Chrome shortcut:

    chrome.exe" -ssl-version-min=tls 1

    Note I haven't actually tested this...
     

    Attached Files:

    Victek, Oct 15, 2014
    #12
  13. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,659
    Fox-IT blog:
    http://blog.fox-it.com/2014/10/15/poodle/

     
    FanJ, Oct 15, 2014
    #13
  14. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,883
    Location:
    Slovenia, EU
    The problem with Chrome is that those flags are not used if other application launches Chrome (let's say Outlook). I hope that they will add this option in settings in future release.
     
    Minimalist, Oct 15, 2014
    #14
  15. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    MrBrian, Oct 15, 2014
    #15
  16. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands

    Attached Files:

    Rasheed187, Oct 15, 2014
    #16
  17. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,883
    Location:
    Slovenia, EU
    Minimalist, Oct 16, 2014
    #17
  18. anon

    anon Registered Member

    Joined:
    Dec 27, 2012
    Posts:
    8,009
    :thumb:
     
    Last edited: Oct 16, 2014
    anon, Oct 16, 2014
    #18
  19. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,016
    Location:
    U.S.A.
    JRViejo, Oct 16, 2014
    #19
  20. siljaline

    siljaline Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    6,617
    siljaline, Oct 16, 2014
    #20
  21. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,102
    Location:
    Texas
    http://www.net-security.org/secworld.php?id=17503
     
    ronjor, Oct 16, 2014
    #21
  22. lotuseclat79

    lotuseclat79 Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    5,390
    How to secure your ISPConfig 3 server against the poodle SSL attack by Till Brehm.

    -- Tom
     
    lotuseclat79, Oct 16, 2014
    #22
  23. Veeshush

    Veeshush Registered Member

    Joined:
    Mar 16, 2014
    Posts:
    643
    Veeshush, Oct 16, 2014
    #23
  24. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    MrBrian, Oct 17, 2014
    #24
  25. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,102
    Location:
    Texas
    http://www.kb.cert.org/vuls/id/577193
     
    ronjor, Oct 17, 2014
    #25
Page 1 of 2
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...