Synopsis:

POODLE is a vulnerability in the design of SSL version 3.0. POODLE is actually an acronym for Padding Oracle On Downgraded Legacy Encryption. The vulnerability allows the decryption to plaintext of secure connections. The bug was discovered by Google Security Team researcher Bodo Möller in collaboration with Thai Duong and Krzysztof Kotowicz.

Description:

POODLE vulnerability relates to the flaw in CBC ciphers used in SSLv3. The attack is feasible when a higher SSL connection (TLS 1.0 - 1.2) is downgraded to SSLv3. As the CBC ciphers used in SSLv3 are non deterministic in nature hence allows for decrpytion of SSL Connection. There is no practicle workaround to this attack and hence it is recommended to avoid SSLv3 entirely.

For more information on POODLE:-

POODLE Official announcement website

POODLE attacks on SSLv3 at ImperialViolet

Mitigation:

The vulnerability affects the server which support SSL version 3.0 using CBC ciphers. However since its a implementation bug and the remaining RC4 cipher suites are aleady considered vulnerable hence it is recommended to disable SSLv3 completely.

• Disable SSLv3 completely.
• If SSLv3 needs to be enabled then ensure TLS_FALLBACK_SCSV mode is enabled on the server.
• From client prespective we should ensure that browsers do not support SSLv3.

For more details:

OWASP Transport Layer Protection Cheat Sheet

Testing for SSL TLS

OWASP TOP 10 2013 Sensitive Data Exposure

CVSS Base Score:

4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)