2

Need your expert advice for the following -

  1. POODLE - We can deduce if a server is vulnerable to poodle if it supports sslv3 protocol and uses CBC Ciphers.

  2. BEAST - Any server supporting sslv3 OR TLS 1.0 and uses CBC Ciphers.

Is my understanding correct? I understand these attacks are exploited on client side but still if a server can be made vulnerable by any means it is vulnerable.

Now, comes the detection part - AFAIK server does not send the complete list of cipher suits to the client but only sends the selected one based on the cipher suits presented to it by the client.

Now, using nmap ssl_enum_ciphers script we can list the cipher suites used by server.

This is what nmap documentation says about ssl_enum_ciphers script:

This script repeatedly initiates SSLv3/TLS connections, 
each time trying a new cipher or compressor while recording
whether a host accepts or rejects it.
The end result is a list of all the ciphersuites and compressors that a server accepts.

Some servers use the client's ciphersuite ordering:
they choose the first of the client's offered suites that they also support.
Other servers prefer their own ordering:
they choose their most preferred suite from among those the client offers.
In the case of server ordering, the script makes extra probes to discover the server's sorted preference list.
Otherwise, the list is sorted alphabetically.

So, if the server's preferred cipher is RC4 and client provides a CBC cipher (Only one) will it select CBC or rejects the request?

If it chooses CBC then ir-respective of the cipher ordering (nmap's output) then it is vulnerable (?).

If it chooses from client's ciphersuite ordering then definitely it is vulnerable (if it accepts CBC cipher) (?).

Based on above statements, can we infer the following -

  1. If server supports sslv3 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to POODLE?
  2. If server supports sslv3/tls 1.0 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to BEAST?

What i am trying to understand is that based on nmap's output can i infer if it is vulnerable just seeing if it contains CBC cipher or is there any other sophistication involved?

  • 1
    please read the nmap manual for how the script operates: nmap.org/nsedoc/scripts/ssl-enum-ciphers.html – schroeder Feb 18 '16 at 18:37
  • That link will also explain that the script warns if the target is vulnerable to POODLE. – schroeder Feb 18 '16 at 18:42
  • Thanks @schroeder ...I have edited my question after going through the nmap's documentation but still have few questions. Could you pls help with those? – Ouney Feb 19 '16 at 4:27
1

So, if the server's preferred cipher is RC4 and client provides a CBC cipher (Only one) will it select CBC or rejects the request?

If the server supports the CBC cipher that the client provides, the CBC cipher will be used. Otherwise, the connection will fail.

If it chooses CBC then ir-respective of the cipher ordering (nmap's output) then it is vulnerable (?). If it chooses from client's ciphersuite ordering then definitely it is vulnerable (if it accepts CBC cipher) (?).

Every SSLv3 connection to this server using CBC cipher will be vulnerable to POODLE. For BEAST it is a bit more complicated as browsers may implement client-side mitigation.

i) If server supports sslv3 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to POODLE?

No. To be vulnerable to POODLE, the server must have support for a CBC cipher using SSLv3. If the server only supports RC4 with SSLv3 and CBC ciphers are only supported using TLSv1+, it won't be vulnerable to POODLE.

ii) If server supports sslv3/tls 1.0 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to BEAST?

Yes, but BEAST attack is not anymore a problem as every modern browser implements client side mitigation of the attack.

What i am trying to understand is that based on nmap's output can i infer if it is vulnerable just seeing if it contains CBC cipher or is there any other sophistication involved?

Finally, yes:

  • SSLv3 + CBC = POODLE and BEAST
  • TLSv1.0 + CBC = BEAST

Example 1, the following configuration is only vulnerable to BEAST with TLSv1.0 if one of the CBC cipher suite is used:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 256) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 256) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C

Example 2, the following configuration is only vulnerable to POODLE and BEAST on SSLv3:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C

Example 3 from nmap documentation, the configuration is vulnerable to POODLE on SSLv3 and BEAST on SSLv3 and TLCv1.0 is a CBC cipher suite is used:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 256) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 256) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C
  • Thanks a lot for your answer, But i have read somewhere that some implementations of TLS 1.0 also have poodle vulnerability as they did not implement the specifications properly. So, can we say that at worst case TLS 1.0 + CBC is also vulnerable to POODLE? Also, to check for CBC cipher - Is search for the word "CBC" sufficient to establish if a cipher is CBC or are there any exceptions to it? – Ouney Feb 21 '16 at 11:55
  • POODLE can also affect both TLS 1.0 and TLS 1.1; see globalsign.com/en/blog/… and blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls – Anti-weakpasswords Feb 22 '16 at 2:45
  • 1
    POODLE can also affect every version of TLS (including 1.2) that is not implemented as described in RFC 4346 section 6.2.3.2. CBC Block Cipher subsection padding. However as TLS by definition is immune to POODLE, you have to detect that the server does not implement correctly the RFC. To detect this you have to send an invalid packet and make sure the server closes the connection when receiving it. So short story you cannot assume that because a server supports CBC cipher suite with TLS, it is vulnerable to POODLE over TLS – Jyo de Lys Feb 22 '16 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.