neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed soon:)

[mancha <mancha1 () zoho com>]

On Fri, Oct 17, 2014 at 03:40:31PM -0400, Daniel Kahn Gillmor wrote:
> Please see: http://www.gnutls.org/security.html#GNUTLS-SA-2014-4
>
> and Nikos' writeup here:
>
>  http://nmav.gnutls.org/2014/10/what-about-poodle.html
>
> From the latter link:
>
> > > > The good news is, that only browsers use this construct, and no
> > > > other applications should be affected.
>
> Nikos (or anyone else on OSS-security), are you sure that only
> browsers do this?  what about mail clients like Thunderbird or
> Mail.app making IMAPS or POPS or submission connections?

SSLv3 is vulnerable to padding oracle attacks on CBC-mode ciphers. This
vulnerability, tagged CVE-2014-3566, exists independently of types of
clients, servers, or protocols being layered over SSL/TLS.

POODLE is a specific attack vector that leverages "protocol fallback" in
order to exploit CVE-2014-3566.

Notwithstanding reports like "The good news is, that only browsers use
this construct, and no other applications should be affected." [1] and
"Currently, only HTTPs clients perform out-of-band protocol fallback."
[2], I can confirm what you're hinting at.

Browsers are not the only client-side applications that implement
"protocol fallback". The below transcript shows an MITM-triggered
Thunderbird 24.7.0 IMAPS protocol downgrade to SSLv3 even though both
peers speak TLSv1.

--mancha

[1] http://nmav.gnutls.org/2014/10/what-about-poodle.html
[2] https://access.redhat.com/node/1232123

========= transcript ============
Setting up mancha-in-the-middle...

127.0.0.1:44366 -> 127.0.0.1:993
handshake               [tls1.0]        (client_hello)

Start protocol downgrade attack...

127.0.0.1:44371 -> 127.0.0.1:993
handshake               [ssl3.0]        (client_hello)

127.0.0.1:993 -> 127.0.0.1:44371
handshake               [ssl3.0]        (server_hello)
handshake               [ssl3.0]        (certificate)
handshake               [ssl3.0]        (server_key_exchange)
handshake               [ssl3.0]        (server_hello_done)

127.0.0.1:44371 -> 127.0.0.1:993
handshake               [ssl3.0]        (client_key_exchange)
change_cipher_spec      [ssl3.0]
handshake               [ssl3.0]        (encrypted)

127.0.0.1:993 -> 127.0.0.1:44371
change_cipher_spec      [ssl3.0]
handshake               [ssl3.0]        (encrypted)

127.0.0.1:993 -> 127.0.0.1:44371
application_data        [ssl3.0]
application_data        [ssl3.0]
=================================

Attachment: _bin
Description: