1

I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to avoid this. This is issue they have reported :-

" It determined that the remote server supports SSLv3 with at least one CBC cipher suite, indicating that this server is vulnerable. It appears that TLSv1 or newer is supported on the server. However, the Fallback SCSV mechanism is not supported, allowing connections to be "rolled back" to SSLv3 "

SSL Version : SSLv3 High Strength Ciphers (>= 112-bit key) 
EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES-CBC(168) Mac=SHA1 
DHE-RSA-AES128-SHA Kx=DH Au=RSA Enc=AES-CBC(128) Mac=SHA1

I read somewhere in site to check whether SSLv3 is disabled using

openssl s_client -connect example.com:443 -ssl3

I tried with the same command but I always get:

[...]SSL routines:SSL3_READ_BYTES:ssl alert handshake failure

This should mean SSLv3 is disabled, correct? If this is so, then they should not have reported this issue.

How can this issue be replicated, and how can I disable SSLv3 (Apache Tomcat) as requested?

Any help/guidance would be appreciated.

4
  • Just being pedantic, but make sure you double check the port, ssl can run on other ports than 443.
    – wireghoul
    Jan 14, 2015 at 6:37
  • @wireghoul thanks for your quick response..how can i check which ssl port is using my website.and does it replicate the issue like reported by with cipher information also ? Jan 14, 2015 at 7:02
  • I expect you would get that information from the security report you referenced in the OP
    – wireghoul
    Jan 14, 2015 at 8:42
  • Also keep in mind if your webserver is behind a load balancer that is offloading/inspecting/handling SSL traffic it may be vulnerable.
    – k1DBLITZ
    Jan 30, 2015 at 18:29

1 Answer 1

2

you can check your ssl-setup with either:

you should have a basic knowledge on how to interpret the results though

for disabling ssl in your tomcat please read (there might be interferences yiwth the JVM used):

"When using Tomcat with the JSSE connectors, the SSL protocol to be used can be configured via $TOMCAT_HOME/conf/server.xml. The following example shows how the sslProtocol in an https connector is configured.

Tomcat 5 and 6 (prior to 6.0.38)
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" />
Tomcat 6 (6.0.38 and later) and 7
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

If the sslEnabledProtocols or sslProtocols attributes are specified, only protocols that are listed and supported by the SSL implementation will be enabled. If not specified, the JVM default is used. The permitted values may be obtained from the JVM documentation for the allowed values for algorithm when creating an SSLContext instance e.g. Oracle Java 6 and Oracle Java 7."

1
  • @ thanks for your reply..i got how to disable sslv3.. I want to test whether my website has any poodle/ssl3 vulnerability locally where our url ll be like localhost:8080/test,am using windows Jan 19, 2015 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .