POODLE: SSLv3.0 vulnerability (CVE-2014-3566)

[chris]

Check which serives are available with SSLv3.0, see:

• ​https://access.redhat.com/articles/1232123
• ​https://www.openssl.org/~bodo/ssl-poodle.pdf
• ​https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3566

and disable SSLv3.0 where it is being offered.

[chris]

A couple more links:

• ​http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566
• ​http://googleonlinesecurity.blogspot.de/2014/10/this-poodle-bites-exploiting-ssl-30.html

[chris]

This will be fixed for PuffinServer by ticket:798

[chris]

PenguinServer and ParrotServer were vulnerable:

• ​https://www.ssllabs.com/ssltest/analyze.html?d=parrot.transitionnetwork.org&hideResults=on
• ​https://www.ssllabs.com/ssltest/analyze.html?d=penguin.transitionnetwork.org&hideResults=on

On PenguinServer, find the files to edit:

cd /etc/nginx/
grep -rli sslv3 .
./sites-available/stats
./sites-available/tech
./sites-available/static
./sites-available/default
./sites-available/intransitionmovie
./sites-available/penguin
./sites-available/ttarchive
./sites-available/wiki.bak
./sites-available/patterns
./sites-available/wiki

Edit in vim:

:1,$s/ssl_protocols SSLv3 /ssl_protocols /gc

Restart Nginx.

ParrotServer edit /etc/apache2/mods-available/ssl.conf

#SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2

Restart Apache.