According to a Qualys Blog, POODLE can now be used against TLS (all versions). I've read separately that in order to execute POODLE against TLS, the server must skip a step in validating the padding. Most sources name two manufacturers which skip this step.

How would an administrator verify or fix their implementation so that they are not vulnerable? (for example, if the company runs their own dedicated web server)

  • A slight correction: POODLE can be used against certain defective TLS implementations. Correctly-implemented TLS is immune to POODLE. – Mark Dec 9 '14 at 21:16

The blog you linked says to use the SSL Labs test for verifying and, if vulnerable, apply the patch supplied by your vendor.

If the company wrote their own web server, they are the vendor and will have to write their own patch.

| improve this answer | |
  • 1
    Incidentally, anyone that runs their own windows web server, windows uses Schannel and is not vulnerable to this version of the POODLE attack. – ton.yeung Dec 9 '14 at 17:29
  • Do you know how they perform this test? I would like to test some servers that are not reachable from the open web. – span Dec 12 '14 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.