oss-sec mailing list archives
Re: Truly scary SSL 3.0 vuln to be revealed soon:
From: Pierre Schweitzer <pierre () reactos org>
Date: Wed, 15 Oct 2014 08:12:22 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, For "standard" IT people, this was kind of a good thing actually. Without knowing anything about the vulnerability itself, you were at least aware that something totally wrong was coming with SSLv3. So, it was letting a few hours to disable (for instance) SSLv3 on the infrastructure (or to check it had been properly done a while ago) before the issue comes out publicly with all the details and eventually PoC to exploit it. That's kind of great opportunity to make sure we're safe before it gets wrong. Just my 2 cents. On 10/15/2014 07:28 AM, Sona Sarmadi wrote:
Thanks Hanno, A reflection: Maybe we shouldn't post information like this here or somewhere else which is not published yet even if the information has leak out? Although all members here are reliable but it is still an open mailing list and we should be careful and act more responsible. Cheers SonaIt's out: https://www.openssl.org/~bodo/ssl-poodle.pdf http://googleonlinesecurity.blogspot.de/2014/10/this-poodle-bites-
exploiting-ssl-30.html
My conclusion stays the same: Disable SSLv3. -- Hanno Böck http://hboeck.de/ mail/jabber: hanno () hboeck de GPG: BBB51E42
- -- Pierre Schweitzer <pierre () reactos org> System & Network Administrator Senior Kernel Developer ReactOS Deutschland e.V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUPhBBAAoJEHVFVWw9WFsLG5AQAIRUEYp0f9Wt73J4YjhzPweB 9CEfmF6GN4Tp8GgH35dRCU2cQrh28CEuQPjFC/ay3CkcjBnmtc0n69BjwFP6m8bc sW9XzLifQQ85UiMA5Zyr1C94TAlso+c77xk0EVh7hu8B5iwXwYwRFD4+BKMumDXx nQOKJzq0EbSswDngZqP+54sO4pafytI8XfcGWhmIvC7oSwIxacY8O1UBrwVYWTca s4ukOpZB5eZtVzCjWaKojzd01/dsLYHXny6aUOzV4/+I/z77WymbCaUZxjGLg7Om ej26rAZeDRLjCu8uusK5ejJYvpMKs0E7c/xzCMHgzlXiZNHulVo213wD1NKdA4MY Rw7tA3jo1WqOw8/j9XRhtHpUGhGnYERtWV1+4rAPjJ6cZinz5ooinR6hNCbAXKz/ wxhgRhauxjgM2vCE2hd0T/PBjY6mP6IKYUquIsSYRan26XnbRp5Na184q9V92CPw EYgBdSfiuxmF1GT4a2U5OEWeWqEetQtIoLdp/7Ch4nZ7bhkNnGxnVGSEqLZRLd7s zgMyVgDC2L6NnwUd7YyVDE5DR6pgsflp/dnGvwScKfjtbtNV/jASNLKoO5BjOnn/ IOa1fsgdBL5NDw5RFOnSi2ifsY9/7+xCa7VUWKMT5W/XbsABRusgnyJxEKgM5n+B 3S85hEbRiamLnLCbV59A =4kV1 -----END PGP SIGNATURE-----
Current thread:
- Re: list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:), (continued)
- Re: list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) Michal Zalewski (Oct 29)
- Re: list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) Dave Horsfall (Oct 29)
- Re: list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) Michal Zalewski (Oct 29)
- Re: list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) Solar Designer (Nov 03)
- Re: SSL POODLE (Truly scary SSL 3.0 vuln) gremlin (Oct 14)
- Re: SSL POODLE (Truly scary SSL 3.0 vuln) Krassimir Tzvetanov (Oct 14)
- Re: SSL POODLE Florian Weimer (Oct 15)
- Re: SSL POODLE Hanno Böck (Oct 15)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: Reed Loden (Oct 14)
- RE: Truly scary SSL 3.0 vuln to be revealed soon: Sona Sarmadi (Oct 15)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: Pierre Schweitzer (Oct 14)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: mancha (Oct 14)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: Krassimir Tzvetanov (Oct 14)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: Ben Lincoln (0E1C7DBB - OSS) (Oct 15)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: Hanno Böck (Oct 15)
- RE: Truly scary SSL 3.0 vuln to be revealed soon: Sona Sarmadi (Oct 16)
- Re: Truly scary SSL 3.0 vuln to be revealed soon: Daniel Kahn Gillmor (Oct 17)
- neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed soon:) mancha (Oct 17)
- Re: neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed soon:) Nikos Mavrogiannopoulos (Oct 18)