3

I use a commercial email service that provides IMAP over SSL on port 993 and SMTP over SSL on port 465. I currently connect to their servers with Thunderbird and the Apple's iOS8 email client.

Could these connections be vulnerable to POODLE? My impression is that the SSL connection negotiated on these ports might be SSLv3.0. I turned on connection logging in Thunderbird but it does not report the protocol versions. How can I determine the SSL version used for these connections?

My email service also provides regular IMAP on 143 and SMTP on 587 (and other ports). If I force my clients to use STARTTLS, the same question arises about the protocol that is used.

|improve this question
4

Have a look at https://ssl-tools.net/mailservers. There you can get information about the mail server, including the support for SSL 3.0. But, please note that POODLE is about a specific attack pattern which uses a design flaw in SSL 3.0 and which works fine with HTTP to steal session cookies. But, while it is good to disable SSL 3.0 completely, the idea of POODLE can not be easily applied to attack IMAP, POP3 or SMTP protocol to steal the login credentials. This does not mean that these protocols are safe with SSL 3.0, but only that you need to develop a different approach to exploit the flaws in SSL 3.0.

|improve this answer
  • If they are using SSL 3.0 and Basic authentication (probably not a great idea, but people do it) for the mail server, they could potentially steal the WWW-Authenticate header in the same way they are stealing the Set-Cookie header with POODLE. – vcsjones Oct 24 '14 at 19:50
  • We are talking about IMAP, POP3 and SMTP. There is no WWW-Authenticate header in these protocols. I think you confuse this with web-based mail (HTTPS) with basic authentication. – Steffen Ullrich Oct 25 '14 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.