CVE-2014-3566: SSL Poodle Vulnerability - Connect IT Community

/* * These styles apply ONLY to the header and footer assets. */ * { padding: 0; margin: 0; box-sizing: border-box; } .super-nav { display: flex; justify-content: flex-end; align-items: center; margin: 0 auto; max-width: 1264px; padding-left: 40px; padding-right: 40px; height: 40px; text-align: right; } .super-nav a { color: #34427c; margin-right: 20px; padding: 10px; text-decoration: none; } .super-nav a:hover, .super-nav a:focus { background-color: #f7f9fa; } .footer { background: #f5f5f6; color: #555a62; font-size: 14px; line-height: 1.5; padding: 0; } .footer-image { background-image: url("/themes/kaseya/assets/images/footerImage.png"); height: 500px; background-repeat: no-repeat; background-size: cover; margin-top: -100px; } .footer-wrap { padding-left: 18px; padding-right: 18px; max-width: 1236px; margin: 0 auto; } .footer-main-content { background-color: #000; padding: 100px 0; } .footer .footer-col-title { color: #ffffff; font-weight: 700; font-size: 13px; padding-bottom: 10px; text-transform: uppercase; } .footer .footer-link { color: #9b9ca0; text-decoration: none; } .footer .footer-link:hover, .footer .footer-link:focus, .footer .footer-link:active { text-decoration: underline; } .footer-main-content .footer-link { padding-top: 10px; } .footer-row { display: flex; flex-wrap: wrap; justify-content: space-between; align-items: center; margin: -3px; } .footer-main-content-row { align-items: flex-start; } .footer-bottom-content { padding: 10px; align-items: center; } .footer-col { padding: 0 3px; display: flex; flex-direction: column; } .footer-col-copyRight { justify-content: flex-start; color: #9b9ca0; flex: 1; display: flex; } .footer-last-col { flex-direction: row; } .footer-last-col .footer-link { padding-right: 10px; text-transform: uppercase; } @media screen and (max-width: 768px) { .super-nav { padding-right: 0; } .footer-image { height: 250px; } .footer-main-content { padding: 40px 0; } .footer .footer-col-title { padding-top: 10px; } .footer-row:not(.footer-main-content-row) { display: block; } .footer-col:not(.footer-main-content-col) { width: 100%; text-align: center; padding: 10px 0; } .footer-main-content-col { width: 50%; } .footer-last-col { flex-direction: column; } .footer-last-col .footer-link { padding-bottom: 10px; } } /*# sourceMappingURL=styles.css.map */ Ask the Community Groups

CVE-2014-3566: SSL Poodle Vulnerability - Connect IT Community | Kaseya

CVE ID

CVE-2014-3566

DESCRIPTION

The Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability allows a man-in-the-middle attacker to decrypt ciphertext with SSL 3.0 CBC mode padding bytes.

Exploiting this vulnerability is not easily accomplished. Man-in-the-middle attacks require large amounts of time and resources. While likelihood is low, Red Hat recommends implementing only TLS to avoid flaws in SSL. Disabling SSLv3 in favor of at least a TLS connection is recommended.

Red Hat statement

All implementations of SSLv3 are affected. Red Hat Enterprise Linux and other Red Hat products include libraries which enable the use of SSLv3. This vulnerability does not affect the newer encryption mechansim known as Transport Socket Layer (TLS).

To mitigate this vulnerability, you should disable SSLv3 in all affected packages.

Unitrends statement

Risk to Unitrends systems: Low

The attacker has to interject himself as a man-in-the-middle which is difficult and time consuming. He would also need to understand the protocols we use to backup or replicate to intercept any critical data. OpenVPN 2.x also does not support SSLv3.

RESOLUTION

Unitrends disables SSLv3 for web access in /etc/httpd/conf.d/ssl.conf with release 8.0.0-2 and later.

LINK TO ADVISORIES

https://access.redhat.com/articles/1232123 https://access.redhat.com/security/cve/CVE-2014-3566 https://bugzilla.redhat.com/show_bug.cgi?id=1152789