[HUB] POODLE attack exploiting SSL 3.0 fallback

Refers to:

  • Plesk

Created:

2016-11-16 12:53:23 UTC

Modified:

2016-12-21 19:27:50 UTC

0

Was this article helpful?


Have more questions?

Submit a request

[HUB] POODLE attack exploiting SSL 3.0 fallback

Information

A CVE-2014-3566 vulnerability in SSLv3 protocol was identified by the Google security team . There is an additional whitepaper available from OpenSSL that also describes this vulnerability.

You can check if your website is vulnerable with curl:

curl -v3 -X HEAD https://www.example.com

If you are NOT vulnerable, your output should look something like this:

curl: (35) SSL connect error

If you ARE vulnerable, you will see normal connection outputs, potentially including the line:

SSL 3.0 connection using ...

Resolution

Although the possibility to exploit this vulnerability is quite low, the simplest way is to disable SSL 3.0 - this obsoleted protocol version is being used for compatibility needs and is not required for Parallels products.

For specific Parallels products, here is the list of articles which you may refer to:

Have more questions? Submit a request
Please sign in to leave a comment.