2

Need your expert advice for the following -

  1. POODLE - We can deduce if a server is vulnerable to poodle if it supports sslv3 protocol and uses CBC Ciphers.

  2. BEAST - Any server supporting sslv3 OR TLS 1.0 and uses CBC Ciphers.

Is my understanding correct? I understand these attacks are exploited on client side but still if a server can be made vulnerable by any means it is vulnerable.

Now, comes the detection part - AFAIK server does not send the complete list of cipher suits to the client but only sends the selected one based on the cipher suits presented to it by the client.

Now, using nmap ssl_enum_ciphers script we can list the cipher suites used by server.

This is what nmap documentation says about ssl_enum_ciphers script:

This script repeatedly initiates SSLv3/TLS connections, 
each time trying a new cipher or compressor while recording
whether a host accepts or rejects it.
The end result is a list of all the ciphersuites and compressors that a server accepts.

Some servers use the client's ciphersuite ordering:
they choose the first of the client's offered suites that they also support.
Other servers prefer their own ordering:
they choose their most preferred suite from among those the client offers.
In the case of server ordering, the script makes extra probes to discover the server's sorted preference list.
Otherwise, the list is sorted alphabetically.

So, if the server's preferred cipher is RC4 and client provides a CBC cipher (Only one) will it select CBC or rejects the request?

If it chooses CBC then ir-respective of the cipher ordering (nmap's output) then it is vulnerable (?).

If it chooses from client's ciphersuite ordering then definitely it is vulnerable (if it accepts CBC cipher) (?).

Based on above statements, can we infer the following -

  1. If server supports sslv3 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to POODLE?
  2. If server supports sslv3/tls 1.0 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to BEAST?

What i am trying to understand is that based on nmap's output can i infer if it is vulnerable just seeing if it contains CBC cipher or is there any other sophistication involved?

3
  • 1
    please read the nmap manual for how the script operates: nmap.org/nsedoc/scripts/ssl-enum-ciphers.html
    – schroeder
    Commented Feb 18, 2016 at 18:37
  • That link will also explain that the script warns if the target is vulnerable to POODLE.
    – schroeder
    Commented Feb 18, 2016 at 18:42
  • Thanks @schroeder ...I have edited my question after going through the nmap's documentation but still have few questions. Could you pls help with those?
    – Ouney
    Commented Feb 19, 2016 at 4:27

1 Answer 1

1

So, if the server's preferred cipher is RC4 and client provides a CBC cipher (Only one) will it select CBC or rejects the request?

If the server supports the CBC cipher that the client provides, the CBC cipher will be used. Otherwise, the connection will fail.

If it chooses CBC then ir-respective of the cipher ordering (nmap's output) then it is vulnerable (?). If it chooses from client's ciphersuite ordering then definitely it is vulnerable (if it accepts CBC cipher) (?).

Every SSLv3 connection to this server using CBC cipher will be vulnerable to POODLE. For BEAST it is a bit more complicated as browsers may implement client-side mitigation.

i) If server supports sslv3 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to POODLE?

No. To be vulnerable to POODLE, the server must have support for a CBC cipher using SSLv3. If the server only supports RC4 with SSLv3 and CBC ciphers are only supported using TLSv1+, it won't be vulnerable to POODLE.

ii) If server supports sslv3/tls 1.0 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to BEAST?

Yes, but BEAST attack is not anymore a problem as every modern browser implements client side mitigation of the attack.

What i am trying to understand is that based on nmap's output can i infer if it is vulnerable just seeing if it contains CBC cipher or is there any other sophistication involved?

Finally, yes:

  • SSLv3 + CBC = POODLE and BEAST
  • TLSv1.0 + CBC = BEAST

Example 1, the following configuration is only vulnerable to BEAST with TLSv1.0 if one of the CBC cipher suite is used:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 256) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 256) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C

Example 2, the following configuration is only vulnerable to POODLE and BEAST on SSLv3:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C

Example 3 from nmap documentation, the configuration is vulnerable to POODLE on SSLv3 and BEAST on SSLv3 and TLCv1.0 is a CBC cipher suite is used:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 256) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 256) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C
3
  • Thanks a lot for your answer, But i have read somewhere that some implementations of TLS 1.0 also have poodle vulnerability as they did not implement the specifications properly. So, can we say that at worst case TLS 1.0 + CBC is also vulnerable to POODLE? Also, to check for CBC cipher - Is search for the word "CBC" sufficient to establish if a cipher is CBC or are there any exceptions to it?
    – Ouney
    Commented Feb 21, 2016 at 11:55
  • POODLE can also affect both TLS 1.0 and TLS 1.1; see globalsign.com/en/blog/… and blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls Commented Feb 22, 2016 at 2:45
  • 1
    POODLE can also affect every version of TLS (including 1.2) that is not implemented as described in RFC 4346 section 6.2.3.2. CBC Block Cipher subsection padding. However as TLS by definition is immune to POODLE, you have to detect that the server does not implement correctly the RFC. To detect this you have to send an invalid packet and make sure the server closes the connection when receiving it. So short story you cannot assume that because a server supports CBC cipher suite with TLS, it is vulnerable to POODLE over TLS
    – Jyo de Lys
    Commented Feb 22, 2016 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .