3

I use a commercial email service that provides IMAP over SSL on port 993 and SMTP over SSL on port 465. I currently connect to their servers with Thunderbird and the Apple's iOS8 email client.

Could these connections be vulnerable to POODLE? My impression is that the SSL connection negotiated on these ports might be SSLv3.0. I turned on connection logging in Thunderbird but it does not report the protocol versions. How can I determine the SSL version used for these connections?

My email service also provides regular IMAP on 143 and SMTP on 587 (and other ports). If I force my clients to use STARTTLS, the same question arises about the protocol that is used.

1 Answer 1

4

Have a look at https://ssl-tools.net/mailservers. There you can get information about the mail server, including the support for SSL 3.0. But, please note that POODLE is about a specific attack pattern which uses a design flaw in SSL 3.0 and which works fine with HTTP to steal session cookies. But, while it is good to disable SSL 3.0 completely, the idea of POODLE can not be easily applied to attack IMAP, POP3 or SMTP protocol to steal the login credentials. This does not mean that these protocols are safe with SSL 3.0, but only that you need to develop a different approach to exploit the flaws in SSL 3.0.

2
  • If they are using SSL 3.0 and Basic authentication (probably not a great idea, but people do it) for the mail server, they could potentially steal the WWW-Authenticate header in the same way they are stealing the Set-Cookie header with POODLE.
    – vcsjones
    Oct 24, 2014 at 19:50
  • 1
    We are talking about IMAP, POP3 and SMTP. There is no WWW-Authenticate header in these protocols. I think you confuse this with web-based mail (HTTPS) with basic authentication. Oct 25, 2014 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .