4

I always thought that if a server supports SSLv3 and CBC ciphers, then it is vulnerable to POODLE. But it looks like that is not the case.

For example, for Google.com, SSL Labs says that the SSL POODLE attack is mitigated even though it supports CBC ciphers with SSLv3. On further investigation, I found that if SSL Labs detects that a server prefers RC4 over CBC (SSL 3: 0x5 is mentioned next to SSL POODLE result).

Now MITM can only provide CBC ciphers to Google.com, then it will only choose CBC (out of what I provide), and it will still be vulnerable to POODLE. But then why does SSL Labs says it is not?

2 Answers 2

2

Ivan Ristic explains this in a blog post:

In the short term, it’s possible to mitigate POODLE by avoiding using CBC suites with SSL 3, but that involves relying on a certain insecure stream cipher whose name no one wants to mention. I don’t recommend this approach.

And that insecure stream cipher (suite) is this:

TLS_RSA_WITH_RC4_128_SHA (0x5)
2
  • But that is because ssllabs would have sent client handshake request with stream ciphers in it. My question is - it is possible for a MITM to send only CBC ciphers in that case chosen cipher would be a CBC which makes it poodle vulneable (?).
    – Ouney
    May 9, 2016 at 18:02
  • 1
    If you support CBC ciphers in SSLv3, you're vulnerable to POODLE. Simple as that. The mitigation Google have is the TLS_SCSV_FALLBACK function which makes it impossible for an attacker to downgrade you to SSLv3 if you support TLSv1.0 and your client is SCSV aware.
    – Polynomial
    May 9, 2016 at 18:19
2

Risk scoring is not always clear-cut. Here are some of the considerations SSL Labs has to deal with when scoring a situation like this:

  • Some servers have an operational need to support a wide variety of old or unpatched clients. Prioritizing stream ciphers over CBC ciphers can partially mitigate POODLE from a server's perspective, leaving it up to the client to support the best it can.
  • RC4 is bad, and already caps the score at B (for pre-TLS 1.1 protocols).
  • SSLv3 is bad, and already caps the score at B (fails entirely if nothing but SSLv3 is supported).
  • POODLE is not a high-risk vulnerability for most, since it requires a man-in-the-middle attack and there are many configurations that are not vulnerable.
  • Google probably supports TLS_FALLBACK_SCSV to protect TLS-supporting clients from being forcibly downgraded to the POODLE-prone SSLv3 setup. This is an additional mitigation that ensures only the most out-of-date (i.e. SSLv3-only) clients could be exploited.

Given these inputs, SSL Labs has decided that prioritizing RC4 and supporting TLS_FALLBACK_SCSV is a sufficient server-side mitigation for POODLE, which will also have the effect of reducing the overall score.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .