8

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt

The workaround is to disable SSLv3.

  • Will this disable HTTPS on our website completely?
  • What clients rely on SSLv3 still, should be be concerned about supporting them?
Chris S
  • 77,337
  • 11
  • 120
  • 212
Oxon
  • 265
  • 2
  • 6
  • 3
    No, otherwise people wouldn't suggest to do it. Unless, of course, the only protocol you allow is SSLv3, but that would be uncommon. – gparent Oct 16 '14 at 17:38
  • 2
    With the new edits, this becomes a perfectly legitimate question for this site and doesn't deserve the down-voting. Shane Madden's answer (With +5 votes currently) shows how valuable this question is. Another possible answer would explain that HTTPS may use SSL and/or TLS, and what are the differences between the two. – Stefan Lasiewski Oct 17 '14 at 00:21
  • 12
    Why is this question an upcoming community event? =p – Question Overflow Oct 17 '14 at 02:50
  • @QuestionOverflow Trying to raise awareness of yet another OpenSSL vulnerability. – Chris S Oct 17 '14 at 14:15
  • To be precise, the POODLE vulnerability is in the SSLv3 protocol, not in OpenSSL. The memory leaks fixed in OpenSSL are not part of POODLE. Upgrade OpenSSL to fix the memory leaks. Disable SSlv3 to protect your clients from POODLE. – Gene Gotimer Oct 17 '14 at 21:16
  • @gparent: There are a surprising number of products out there for which SSLv3 is the only option for https. Aside from a few embedded systems the one causing me the biggest headache right now is Lotus Domino. – Adam Oct 18 '14 at 09:45
  • Yeah @Adam, you're right, the question changed a bit since I put that comment there. For a large quantity of browsers, OSes and websites out there, disabling SSLv3 is okay, but that doesn't take into account a really large number of devices or other services that don't meet these criteria. – gparent Oct 19 '14 at 22:25
  • 1
    Considering that HTTPS & SSL have been used interchangeably for years in technical discussions and in configuration files, many admins, including those with "a minimal understanding of the problem being solved", could have the same question. Again, this question is legitimate after the editing and should be re-opened. – Stefan Lasiewski Oct 23 '14 at 18:28
  • 1
    [SSLv3 Is Comprehensively Broken](https://tools.ietf.org/html/rfc7568#page-3) – Raedwald Jun 26 '15 at 12:14

2 Answers2

21

No, it will not break HTTPS connectivity to your website; TLSv1 (and newer versions, if your software is recent enough) is already being used instead by almost all browsers (with the notable exception of IE6 on Windows XP).

Verify in your configuration that TLSv1 is enabled, but it is by default in almost every server-side SSL configuration.

Shane Madden
  • 112,982
  • 12
  • 174
  • 248
  • In addition, some older commandline clients & older appliances might only support SSLv3. – Stefan Lasiewski Oct 17 '14 at 00:16
  • 1
    By simulating a failure in TLS negotiation, those browsers can be forced to fallback to SSLv3. This is why you should disable SSLv3 server-side, and why the major browsers are scrambling to disable SSLv3 client-side in the next updates. If you are totally sure you need to support those old appliances, there is a mitigation: http://serverfault.com/q/637848/249649 – cypres Oct 17 '14 at 18:30
  • 1
    @cypres I think the change in question title from the edit threw you off - the "No" is in response to the [original title question](http://serverfault.com/revisions/637605/1), which has been moved to the body, of "Will this disable HTTPS on our website completely?" I've edited to make that clear. – Shane Madden Oct 17 '14 at 18:32
6

Yes, you should disable SSLv3. Poodle works because browsers will attempt to use older protocols such as SSLv3 if TLS fails. A MITM can abuse this (, unless the new TLS SCSV is supported by the client and server, which only Chrome supports atm.). For a really good writeup on the details of the Poodle attack see: https://security.stackexchange.com/q/70719

SSLv3 is broken in several ways, and the best way to deal with the problem is to disable it, since it was superseded by TLS 15 years ago. If you are using SSLv3 on a website, and you don't care about IE6 on XP (IE7 on XP is good), you should be safe to disable it.

The viability of disabling SSLv3 is being discussed on a related question: Poodle: Is disabling SSL V3 on server really a solution?

While you are at it, you might want to run a test on your site to see if there are any other problems: https://www.ssllabs.com/ssltest/

Community
  • 1
cypres
  • 601
  • 4
  • 13
  • Could you be more specific as to how Shane's answer is incorrect? Thanks! – Chris S Oct 17 '14 at 18:43
  • @ChrisS, I misunderstood Shane. Thought he said that if you have TLS enabled you are good, and don't need to disable SSLv3. His answer after the edit now states that disabling SSLv3 will not break your website, which is correct. But leaving it enabled, regardless of TLS support will not fix Poodle either. I've edited mine to make it more clear. – cypres Oct 17 '14 at 18:49