Normally, servers that support SSL 3.0 are vulnerable to the POODLE attack. But, consider a server that has the following interesting combination of features:
It supports SSL 3.0.
If you connect to it via SSL 3.0, the connection succeeds but it immediately returns a HTTP 302 redirect to a web page on a different host suggesting that you upgrade your browser to a more modern version. Any attempt to connect via SSL 3.0 triggers this auto-redirect; it will never return any content or do anything else.
Is this secure? Or is this also vulnerable to POODLE?
I am suspicious that this might be vulnerable to POODLE. From my understanding of the POODLE attack, the attack only relies on watching whether the server accepts or rejects some particular modified ciphertext. (What the server does after that -- e.g., sending a redirect -- seems irrelevant to the POODLE attack.) However, I'm not sure if I understand all the details. So, is this an effective defense against POODLE?
I do realize the typical advice is to disable SSL 3.0. So, just to be clear: I'm not asking whether you'd encourage me to configure my own server like this; I just want to know if a server that works like described above is secure or insecure. And I suspect there might be a reason why someone would do this: it ensures that IE6 users see a web page asking them to upgrade to a more modern browser, rather than just blocking IE6 entirely. I know about TLS_FALLBACK_SCSV, but my question remains valid for clients that don't support it. So, is this redirect thing an effective defense against POODLE?