Disabling SSL3.0 is one of the ways of mitigating POODLE attack. The other way is to apply the TLS_FALLBACK_SCSV patch. There are downsides for TLS_FALLBACK_SCSV as well:
- Microsoft doesn't support it yet. A bug has been raised in this regard: https://connect.microsoft.com/IE/feedback/details/1002874/internet-explorer-should-send-tls-fallback-scsv
- Both the SSL peers are required to support this cipher suite. i.e., even if your server supports it and the clients coming in dont, we're still vulnerable to POODLE attack.
Now since Microsoft doesnt support TLS_FALLBACK_SCSV yet, the only option for you is to disable SSL3.0. Lets come to the implications of doing this:
- The IE6 browser which doesnt support SSL versions greater than SSL3.0 will NOT be able to establish a SSL communication with your server.
- All other browsers will support TLS1.0 at least. Since you allow TLS1.0 in your server, they will be able to communicate using that.
- For clients advertising versions > TLS1.0, there's no problem at all(since you allow those versions as well)
The reason why SSL3.0 is vulnerable to POODLE is that when it uses CBC mode ciphers, the SSL design doesn't mention that after decrypting the blocks, the padding block needs to be validated. (why is this a problem?: https://www.imperialviolet.org/2014/10/14/poodle.html).
The reason why TLS is not vulnerable is because, it explicitly states that the padding block needs to be checked for a specific pattern. (OpenSSL and most other implementations of TLS fills the padding block with |length of padding block|).
Since this vulnerability exists only if the server and client agree upon a CBC mode cipher, another way to mitigate POODLE attack is to use non-CBC mode ciphers like RC4. But this is NOT recommended as RC-4 ciphers have their own list of weaknesses.