Vulnerability discovered in ssl 3 0
This presentation is the property of its rightful owner.
Sponsored Links
1 / 4

Vulnerability Discovered in SSL 3.0 PowerPoint PPT Presentation


  • 11 Views
  • Uploaded on
  • Presentation posted in: Internet / Web

SSL has been the matter of focus these pasts months and we can't just say it’s finished. Another vulnerability, this time discovered by Google Research Team is SSL 3.0. It’s still being used throughout the Web,While SSL 3.0 has already been around for almost 15 years, and nearly every browser supports it.

Download Presentation

Vulnerability Discovered in SSL 3.0

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Vulnerability discovered in ssl 3 0

Vulnerability Discovered in SSL 3.0


Vulnerability discovered in ssl 3 0

Vulnerability Discovered in SSL 3.0 – The stealth Poodle

SSL has been the matter of focus these pasts months and we cant just say it’s finished. Another vulnerability, this time discovered by Google Research Team is SSL 3.0. It’s still being used throughout the Web,While SSL 3.0 has already been around for almost 15 years, and nearly every browser supports it.

The POODLE vulnerability is a weakness in version 3 of the SSL protocol that allows an attacker in a man-in-the-middle context to decipher the plain text content of an SSLv3 encrypted message.

POODLE as an acronym for Padding Oracle On Downgraded Legacy Encryption, researchers have shown that because of the widespread support for this, an attacker can assume it will be easy to find a situation where an SSLv3 connection can be forced and put to use for capturing private data or cookies.


Vulnerability discovered in ssl 3 0

  • What is being done?

  • First run this command to see if you are vulnerable or not. For Redhat Users:

  • #!/bin/bash ret=$(echo Q | timeout 5 openssls_client -connect "${1-`hostname`}:${2-443}" -ssl3 2> /dev/null) if echo "${ret}" | grep -q 'Protocol.*SSLv3'; then if echo "${ret}" | grep -q 'Cipher.*0000'; then echo "SSL 3.0 disabled" else echo "SSL 3.0 enabled" fi else echo "SSL disabled or other error" fi

  • NOTE: This script takes the hostname of the server to check as the first argument and an optional port as the second. By default it will check the local system, port 443.

  • What actions do you need to take?

  • Developers/Sysadmins need to follow these recommendations in order to make this vulnerability non-exploitable.

  • Disable SSL 3.0 support or disable SSL 3.0 CBC-mode ciphers.

  • Implement the proper use of TLS_FALLBACK_SCSV to remediate the forced downgrade issue that is part of the vulnerability.


Vulnerability discovered in ssl 3 0

ClickIT Customers Protected

Any website or application server, running on hands of the team are already protected against this vulnerability. SSLv3 has been completely disabled for anyone in our managed services plan.

If your server or website is still supporting SSLv3, dont worry! You have always the ClickIT team available to help 24/7!

Article Source:- http://clickittech.weebly.com/blog/vulnerability-discovered-in-ssl-30


  • Login