CVE-2014-3566: Low severity redhat Enterprise Linux vulnerability
Bodo Möller, Thai Duong and Krzysztof Kotowicz of Google discovered a flaw in the design of SSL version 3.0 that would allow an attacker to calculate the plaintext of secure connections, allowing, for example, secure HTTP cookies to be stolen.
References: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html https://www.openssl.org/~bodo/ssl-poodle.pdf
Other sources
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3566?
CVE-2014-3566 is classified as a high-severity vulnerability due to its potential to allow attackers to decrypt secure connections.
How do I fix CVE-2014-3566?
To fix CVE-2014-3566, it is recommended to disable SSL 3.0 in your servers and applications, and switch to TLS.
What systems are affected by CVE-2014-3566?
CVE-2014-3566 affects various versions of operating systems and software including Red Hat, IBM AIX, macOS, and different distributions of Linux.
What can attackers gain from exploiting CVE-2014-3566?
Exploiting CVE-2014-3566 allows attackers to decrypt confidential data transmitted over SSL connections, potentially stealing sensitive information such as cookies.
Is there a workaround for CVE-2014-3566?
Yes, as a temporary workaround for CVE-2014-3566, administrators can restrict the use of SSL 3.0 until a permanent fix is implemented.