Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 17 Oct 2014 22:58:46 +0000
From: mancha <>
Cc: Nikos Mavrogiannopoulos <>,
Subject: neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed

On Fri, Oct 17, 2014 at 03:40:31PM -0400, Daniel Kahn Gillmor wrote:
> Please see:
> and Nikos' writeup here:
> From the latter link:
> >>> The good news is, that only browsers use this construct, and no
> >>> other applications should be affected.
> Nikos (or anyone else on OSS-security), are you sure that only
> browsers do this?  what about mail clients like Thunderbird or
> making IMAPS or POPS or submission connections?

SSLv3 is vulnerable to padding oracle attacks on CBC-mode ciphers. This
vulnerability, tagged CVE-2014-3566, exists independently of types of
clients, servers, or protocols being layered over SSL/TLS.

POODLE is a specific attack vector that leverages "protocol fallback" in
order to exploit CVE-2014-3566.

Notwithstanding reports like "The good news is, that only browsers use
this construct, and no other applications should be affected." [1] and
"Currently, only HTTPs clients perform out-of-band protocol fallback."
[2], I can confirm what you're hinting at.

Browsers are not the only client-side applications that implement
"protocol fallback". The below transcript shows an MITM-triggered
Thunderbird 24.7.0 IMAPS protocol downgrade to SSLv3 even though both
peers speak TLSv1.



========= transcript ============
Setting up mancha-in-the-middle... ->
handshake               [tls1.0]        (client_hello)

Start protocol downgrade attack... ->
handshake               [ssl3.0]        (client_hello) ->
handshake               [ssl3.0]        (server_hello)
handshake               [ssl3.0]        (certificate)
handshake               [ssl3.0]        (server_key_exchange)
handshake               [ssl3.0]        (server_hello_done) ->
handshake               [ssl3.0]        (client_key_exchange)
change_cipher_spec      [ssl3.0]
handshake               [ssl3.0]        (encrypted) ->
change_cipher_spec      [ssl3.0]
handshake               [ssl3.0]        (encrypted) ->
application_data        [ssl3.0]
application_data        [ssl3.0]

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.