Questions tagged [poodle]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
132 views

Am I vulnerable to POODLE or not?

Domain: burian-server.cz What I've tried: user@pc ~ $ curl -v -3 -X HEAD https://burian-server.cz * Rebuilt URL to: https://burian-server.cz/ * Hostname was NOT found in DNS cache * Trying 192.168....
1
vote
2answers
860 views

Unable to disable SSLv3 in Apache for POODLE

One of my client wanted me to upgrade openssl and Apache on his server because he want to receive an A from SSLLabs. I went ahead and upgraded to Apache 2.4.18 and openssl to version 1.0.2e. I then ...
1
vote
1answer
77 views

Google Poodle - SSL and TLS

I am trying to understand this Google Poodle vulnerability slightly better. So I have a server, one thing I need to do is disable SSL. This is not a problem as the number of users that still use SSL ...
2
votes
2answers
4k views

How to disable SSLv3 on esxi5.5

I tried to disable the SSLv3 and enable the TSLv1.2 on my esxi server by changing the following options on /etc/vmware/rhttpproxy/config.xml by adding TLSv1.2. and restarted the hostd and rhttpproxy ...
6
votes
2answers
11k views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
4
votes
1answer
9k views

Disable SSLv3 on Windows Server 2012

I have disabled the SSLv3 on Windows 2012 sever using the following method: http://blog.brankovucinec.com/2014/11/13/disable-the-sslv3-protocol-on-microsoft-windows-servers/ Around the same thing is ...
1
vote
1answer
4k views

Disabling SSLv3 and SSLv2 Protocol On My Ubuntu 14.04 Server

I recently installed a SSL Certificate on my server. Then I tried out this tool to test my newly installed SSL certificate on my server and see if there is no problem. It turned out that it has a ...
0
votes
1answer
463 views

Nginx reverting to sslv3

I'm using nginx as a reverse proxy and I'm trying to turn off sslv3 support. I have found various answers both on here and other various sites. They all suggest all I need to do is add something like ...
0
votes
0answers
520 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false configs....
3
votes
2answers
4k views

Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers

I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (...
1
vote
1answer
2k views

Cannot disable SSL in courier-imap

I cannot disable SSLv2\v3 in courier-imap. In imapd-ssl config I have following: TLS_CIPHER_LIST="ALL:!SSLv2:!SSLv3:!ADH:!NULL:!EXPORT:!DES:!LOW:@STRENGTH" According, to openssl - SSL is disabled ...
1
vote
0answers
710 views

Disabled SSLv3 in Tomcat, but Still Showing POODLE Vulnerability

I have a Windows 2008 server with Tomcat 7.0.59 & Java 8u31 & I am trying to ensure that SSLv3 is disabled. Looking at the changelog for Java, SSL3 should no longer be supported and the Java ...
3
votes
5answers
5k views

Is it possible to disable SSLv3 in Sendmail 8.14.3?

Is it possible to disable SSLv3 in Sendmail 8.14.3? The recommendations that I found is to use -O ServerSSLOptions=... but that option is not recognized. Is there any other way of disabling SSLv3 ...
1
vote
2answers
8k views

How to disable SSLv1/SSLv2/SSLv3 protocols to block Poodle to Apache 2.4.9 on Windows Server 2008 R2?

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.) I still want to have TLSv1.2 protocol on my server. Here ...
3
votes
1answer
2k views

Does my server (still) supports the SSL v3 protocol?

Using https://www.poodlescan.com/ I get for the web site http://ww.israelpost.co.il This server supports the SSL v3 protocol. Using https://www.ssllabs.com/ssltest/analyze.html?d=israelpost.co.il I ...
1
vote
1answer
1k views

IIS Site breaks after disabling SSLv3

I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled ...
1
vote
0answers
346 views

Disable SSL3 on tomcat4

I have a very old web application that uses tomcat4. B/c of the poodle vulnerability I need to disable SSL3 and disable a bunch of weak ciphers. My connector looks like this, but apparently ...
0
votes
0answers
972 views

How to configure Coldfusion 10 CFLDAP to use TLS instead of SSL2

We are using CFLDAP to authenticate users from a remote system. The remote system has now shut down SSL 2 and 3 due to the POODLE issue. Is there a way to configure either Coldfusion or Tomcat to use ...
1
vote
1answer
5k views

What ciphers are compatible with both Java 6/Tomcat 7 and IE8 (XP)?

I have disabled SSL3 and restricted the ciphers available to a recommended set but now I can't access my server using IE8 on Windows XP. If I allow all ciphers then I can connect using IE8 but when I ...
0
votes
1answer
228 views

Getting the right Ciphers for UCSPI SSL

I am currently trying to secure my qmail installation and the SMTP connections. When compiling the standard UCSPI SSL, all supported ciphers are enabled by default. This leads to problems with ...
3
votes
3answers
3k views

Nginx sslv3 poodle disable

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it. My config: add_header Strict-Transport-Security max-age=31536000; add_header X-...
-1
votes
1answer
723 views

Disabled SSLv3 on Apache, but still using it to send to other websites? [closed]

I followed the instructions for CentOS 6 to disable SSL v3 in Apache (2.2.15, not sure how much that matters), but it appears to only disable it for incoming clients, not outgoing requests (such as to ...
4
votes
2answers
1k views

Redirect users connecting with SSLv3 within nginx

I was looking to drop all support for the SSLv3 due to POODLE, but found that there are still some people coming from old browsers for the likes of IE on Windows XP. How do I detect these SSLv3-only ...
2
votes
0answers
33 views

Apache: After disabling SSLv3 for POODLE, can't connect with openssl or java without first specifying -tls1 [duplicate]

Recently we updated our mod_ssl config to disable SSLv3 for the POODLE attack, and that seems to be working. However, old clients (java 1.6 apps of ours, openssl 0.9.8za on my mac) get a handshake ...
2
votes
2answers
6k views

POODLE Ciphers !SSLv3 = Protocol or cipher suite mismatch

According to: ANNOUNCE: Pound - reverse proxy and load balancer - v2.7d / Robert Segall , following enhancement was added: - added "Disable PROTO" directives (fix for Poodle vulnerability) My system:...
0
votes
1answer
110 views

Does DB2 accept SSL3 connections?

Does DB2 allow connection through Secure Sockets Layer version 3 (SSL3)? To be more exact, will a program using SSL3 connection get an access to DB2? or will it fail? If it does accept it, is there ...
2
votes
1answer
391 views

Can you force Windows to disallow SSL in all WINHTTP and HTTPAPI system calls?

Title says it all. Is there a registry setting or something that will prevent the Windows built-in libraries: WINHTTP and HTTPAPI to not support SSL3?
6
votes
2answers
1k views

How switching off SSLv3 in Courier-IMAP server affects old Mail User Agents?

I would like to mitigate POODLE vuln. in my courier-imap server. I know how to do it. I'm really concerned on how it will affect MUA's, especially the older ones. There are still users using Outlook ...
13
votes
1answer
11k views

Passing SSL protocol info to backend via HTTP header

After Poodle vulnerability was revealed recently, our team decided to move on from SSLv3. But before complete removal, they want to warn the daily users that their browser use deprecated SSLv3. So, we ...
12
votes
2answers
15k views

Disabling SSLv3 but still supporting SSLv2Hello in Apache

Many SSL clients, notably JDK 6, use the SSLv2Hello protocol to handshake with the server. Using this protocol does not mean you are using SSL 2.0 or 3.0 for that matter; it is merely a handshake to ...
4
votes
1answer
811 views

Poodle Exploit - Disable SSL v3 on a website specific basis

I'm looking for a very specific situation here with this Poodle exploit. I have a need to disable SSL v2/3 on a subset of my IIS websites, but leave SSL 2/3 available on a few others. Is it possible ...
19
votes
1answer
5k views

How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: https://www.ssllabs.com/ssltest/analyze....
40
votes
7answers
50k views

Poodle: Is disabling SSL V3 on server really a solution?

I've been reading all day about the Poodle vulnerability and it I am bit confused now vs Security and Revenue. If I disable SSL V3 on Server (SSL V2 and V3 both will be disabled for Apache) clients ...
20
votes
8answers
80k views

How do I disable SSLv3 support in Apache Tomcat?

I am trying to reconfigure my Apache Tomcat server to only use TLSv1. However, it is still falling back to SSLv3 using certain browsers. I setup the <connector> tag with the following settings: ...
1
vote
2answers
2k views

POODLE: SSLv3 vulnerability (CVE-2014-3566) with Apache24 on FreeBSD-9.2

I'm using FreeBSD 9.2-RELEASE-p5 with apache24-2.4.10_2 package. According to CVE-2014-3566 (POODLE), I went ahead and disabled SSLProtocol -SSLv3 following by restart of apache24 service, yet after ...