[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141017225846.GA25470@zoho.com>
Date: Fri, 17 Oct 2014 22:58:46 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Cc: Nikos Mavrogiannopoulos <nmav@...tls.org>, dkg@...thhorseman.net
Subject: neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed
soon:)
On Fri, Oct 17, 2014 at 03:40:31PM -0400, Daniel Kahn Gillmor wrote:
> Please see: http://www.gnutls.org/security.html#GNUTLS-SA-2014-4
>
> and Nikos' writeup here:
>
> http://nmav.gnutls.org/2014/10/what-about-poodle.html
>
> From the latter link:
>
> >>> The good news is, that only browsers use this construct, and no
> >>> other applications should be affected.
>
> Nikos (or anyone else on OSS-security), are you sure that only
> browsers do this? what about mail clients like Thunderbird or
> Mail.app making IMAPS or POPS or submission connections?
SSLv3 is vulnerable to padding oracle attacks on CBC-mode ciphers. This
vulnerability, tagged CVE-2014-3566, exists independently of types of
clients, servers, or protocols being layered over SSL/TLS.
POODLE is a specific attack vector that leverages "protocol fallback" in
order to exploit CVE-2014-3566.
Notwithstanding reports like "The good news is, that only browsers use
this construct, and no other applications should be affected." [1] and
"Currently, only HTTPs clients perform out-of-band protocol fallback."
[2], I can confirm what you're hinting at.
Browsers are not the only client-side applications that implement
"protocol fallback". The below transcript shows an MITM-triggered
Thunderbird 24.7.0 IMAPS protocol downgrade to SSLv3 even though both
peers speak TLSv1.
--mancha
[1] http://nmav.gnutls.org/2014/10/what-about-poodle.html
[2] https://access.redhat.com/node/1232123
========= transcript ============
Setting up mancha-in-the-middle...
127.0.0.1:44366 -> 127.0.0.1:993
handshake [tls1.0] (client_hello)
Start protocol downgrade attack...
127.0.0.1:44371 -> 127.0.0.1:993
handshake [ssl3.0] (client_hello)
127.0.0.1:993 -> 127.0.0.1:44371
handshake [ssl3.0] (server_hello)
handshake [ssl3.0] (certificate)
handshake [ssl3.0] (server_key_exchange)
handshake [ssl3.0] (server_hello_done)
127.0.0.1:44371 -> 127.0.0.1:993
handshake [ssl3.0] (client_key_exchange)
change_cipher_spec [ssl3.0]
handshake [ssl3.0] (encrypted)
127.0.0.1:993 -> 127.0.0.1:44371
change_cipher_spec [ssl3.0]
handshake [ssl3.0] (encrypted)
127.0.0.1:993 -> 127.0.0.1:44371
application_data [ssl3.0]
application_data [ssl3.0]
=================================
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
