6

I have a Java based application (running on java 5 or higher) that establishes an SSL connection towards an Apache tomcat 7.0.47 on java 7.

From what I understand, to exploit POODLE you need a client that explicitly does out-of-protocol downgrading. Something that web browsers do all the time, but very few other clients do. So I wonder since both sides (server & client) are java based and not web browser if my application is at risk because of POODLE vulnerability?

  • 2
    Vulnerable in what way? The POODLE vulnerability seems to primarily apply to browsers as the algorithm is complex and would be most easily delivered via malicious Javascript. However, any MITM attack could also achieve the same functionality. – OldCurmudgeon Oct 23 '14 at 13:51
  • 1
    To exploit POODLE you need a client/server pair talking SSLv3. If such a pair is not already in place, then in some cases protocol downgrading can be used to arrange more ideal conditions. However, it's really SSLv3 or not that's the core issue, the downgrade stuff is just a side issue. Suggest you google "java client disable sslv3" and go from there. – gowenfawr Oct 23 '14 at 14:17
1

POODLE is a vulnerability in the SSLv3 protocol, specifically in how it handles padding for block ciphers (RC4, being a stream cipher, isn't vulnerable, but it has its own weaknesses).

  1. Do the client and server talk to each other using SSLv3?
  2. Can a man-in-the-middle attacker coerce them into talking using SSLv3?

If the answer to either of the above questions is "yes", then the client/server pair is potentially vulnerable. Actually performing the attack depends on the details of how the client and server work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.