Poodle – SSLv3 Vulnerability

In the space of a month, yet another security vulnerability has been identified and announced.

Known as the ‘SSLv3 protocol vulnerability and POODLE Attack’, (aka “POODLEbleed”, referencing the the recent Heartbleed vulnerability), the SSL Man In The Middle (MITM) Information Disclosure Vulnerability (CVE-2014-3566) affects version 3.0 of SSL, which was introduced in 1996, and has since been superseded by several newer versions of its successor protocol, TLS. However, the vulnerability may still be exploited because SSL 3.0 continues to be supported by nearly every Web browser and a large number of Web servers.

When web browsers fail at connecting on a newer SSL version (i.e. TLS 1.0, 1.1, or 1.2), they may fall back to a SSL 3.0 connection. Because a network attacker can cause connection failures, including the failure of TLS 1.0/1.1/1.2 connections, they can force the use of SSL 3.0 and then exploit the poodle bug in order to decrypt secure content transmitted between a server and a browser.

All systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios.

On 26 September 2014, the Shellshock vulnerability affecting many versions of Linux and Unix, was announced.

Digital Tsunami hosts the websites of listed companies and multi-national corporations (MNCs) on their private clouds or international brands and national SMEs on private clouds which are exclusive to Digital Tsunami clients.

Security is uppermost in the priorities of Digital Tsunami and sites are constantly monitored and hardware and software maintained for maximum protection.

For enquiries on advanced security for your web presence, please contact Digital Tsunami Sales or Technical Support.

Read more items related to security.

 

External References:

Online Poodle Bug Server Test
Poodlebleed.com
Red Hat Security Advisory on POODLE
Symantec
Trend Micro
US Computer Emergency Readiness Team, Alert TA14-290A

From Our Clients

Quotation Mark

We are delighted with our new website and early feedback from clients and associates is very positive.

The overall impression is that it is a very professional, informative website and conveys the feeling that Sefiani is a quality organisation with skilled, friendly staff.

Thank you for all your help and patience in working with us for this successful outcome.

Robyn Sefiani
Managing Director
Sydney, NSW, Australia
Sefiani Communications Group
Quotation Mark

I would like to thank you for your tremendous contribution to Foodbank over the years.

The organisation certainly wouldn’t be where we are today without your support!

Lyndon Pereira
Analysis & Design Co-ordinator
Sydney, Australia
Quotation Mark

You have demonstrated patience, perseverance, attention to detail and a rare ability to perceive what was needed even when we didn't. We are delighted with the site, it performs and looks great and our enquiry rate since it superseded our previous website has already increased by 20%.

David Chapman
Operations Manager
Bankstown, NSW, Australia
Aerospace Aviation
Quotation Mark

Thanks to you and the Taishan production crew. Andy and the rest of the team were outstanding. Their professionalism was evident the entire time and they seemed to build a nice relationship with the factory employees, which led to a real spirit of cooperation. My sincere thanks for a job extremely well done.

Stephen Pollack
Marketing Director
Lexington, Kentucky, USA
Kaba Mas
Quotation Mark

I'm very pleased with my new website. Clean, crisp and well-ordered. Many thanks to Andrew and the team at Digital Tsunami for their speedy work and dedicated follow up, ensuring a glitch-free launch!

Stephanie Oley
Writer, Editor, Translator
Sydney, NSW, Australia
error: We appreciate that you value our content. You are welcome to link to this page, but content is copyright protected.