[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 18 Oct 2014 09:01:55 +0200
From: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@...il.com>
To: mancha <mancha1@...o.com>,oss-security@...ts.openwall.com
CC: Nikos Mavrogiannopoulos <nmav@...tls.org>,dkg@...thhorseman.net
Subject: Re: neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed soon:)
Hi,
The attack that you describe below is not an attack on tls negotiation. If you would be using the gnutls api as documented it wouldn't work. It is an attack on the insecure negotiation used by firefox, which as it seems it shares code with thunderbird. The text in my description is accurate, the attack affects mostly browsers, and if you are using the tls protocol negotiation you are safe.
On 18 October 2014 00:58:46 CEST, mancha <mancha1@...o.com> wrote:
>On Fri, Oct 17, 2014 at 03:40:31PM -0400, Daniel Kahn Gillmor wrote:
>> Please see: http://www.gnutls.org/security.html#GNUTLS-SA-2014-4
>>
>> and Nikos' writeup here:
>>
>> http://nmav.gnutls.org/2014/10/what-about-poodle.html
>>
>> From the latter link:
>>
>> >>> The good news is, that only browsers use this construct, and no
>> >>> other applications should be affected.
>>
>> Nikos (or anyone else on OSS-security), are you sure that only
>> browsers do this? what about mail clients like Thunderbird or
>> Mail.app making IMAPS or POPS or submission connections?
>
>SSLv3 is vulnerable to padding oracle attacks on CBC-mode ciphers. This
>vulnerability, tagged CVE-2014-3566, exists independently of types of
>clients, servers, or protocols being layered over SSL/TLS.
>
>POODLE is a specific attack vector that leverages "protocol fallback"
>in
>order to exploit CVE-2014-3566.
>
>Notwithstanding reports like "The good news is, that only browsers use
>this construct, and no other applications should be affected." [1] and
>"Currently, only HTTPs clients perform out-of-band protocol fallback."
>[2], I can confirm what you're hinting at.
>
>Browsers are not the only client-side applications that implement
>"protocol fallback". The below transcript shows an MITM-triggered
>Thunderbird 24.7.0 IMAPS protocol downgrade to SSLv3 even though both
>peers speak TLSv1.
>
>--mancha
>
>[1] http://nmav.gnutls.org/2014/10/what-about-poodle.html
>[2] https://access.redhat.com/node/1232123
>
>========= transcript ============
>Setting up mancha-in-the-middle...
>
>127.0.0.1:44366 -> 127.0.0.1:993
>handshake [tls1.0] (client_hello)
>
>Start protocol downgrade attack...
>
>127.0.0.1:44371 -> 127.0.0.1:993
>handshake [ssl3.0] (client_hello)
>
>127.0.0.1:993 -> 127.0.0.1:44371
>handshake [ssl3.0] (server_hello)
>handshake [ssl3.0] (certificate)
>handshake [ssl3.0] (server_key_exchange)
>handshake [ssl3.0] (server_hello_done)
>
>127.0.0.1:44371 -> 127.0.0.1:993
>handshake [ssl3.0] (client_key_exchange)
>change_cipher_spec [ssl3.0]
>handshake [ssl3.0] (encrypted)
>
>127.0.0.1:993 -> 127.0.0.1:44371
>change_cipher_spec [ssl3.0]
>handshake [ssl3.0] (encrypted)
>
>127.0.0.1:993 -> 127.0.0.1:44371
>application_data [ssl3.0]
>application_data [ssl3.0]
>=================================
--
Sent fron my mobile. Please excuse my brevity.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
