Re: neuter the poodle (was: Re: Truly scary SSL 3.0 vuln to be revealed soon:)

[Nikos Mavrogiannopoulos <n.mavrogiannopoulos () gmail com>]

Hi,
The attack that you describe below is not an attack on tls negotiation. If you would be using the gnutls api as 
documented it wouldn't work. It is an attack on the insecure negotiation used by firefox, which as it seems it shares 
code with thunderbird. The text in my description is accurate, the attack affects mostly browsers, and if you are using 
the tls protocol negotiation you are safe.

On 18 October 2014 00:58:46 CEST, mancha <mancha1 () zoho com> wrote:
> On Fri, Oct 17, 2014 at 03:40:31PM -0400, Daniel Kahn Gillmor wrote:
> > Please see: http://www.gnutls.org/security.html#GNUTLS-SA-2014-4
> >
> > and Nikos' writeup here:
> >
> >  http://nmav.gnutls.org/2014/10/what-about-poodle.html
> >
> > From the latter link:
> >
> > > > > The good news is, that only browsers use this construct, and no
> > > > > other applications should be affected.
> >
> > Nikos (or anyone else on OSS-security), are you sure that only
> > browsers do this?  what about mail clients like Thunderbird or
> > Mail.app making IMAPS or POPS or submission connections?
>
> SSLv3 is vulnerable to padding oracle attacks on CBC-mode ciphers. This
> vulnerability, tagged CVE-2014-3566, exists independently of types of
> clients, servers, or protocols being layered over SSL/TLS.
>
> POODLE is a specific attack vector that leverages "protocol fallback"
> in
> order to exploit CVE-2014-3566.
>
> Notwithstanding reports like "The good news is, that only browsers use
> this construct, and no other applications should be affected." [1] and
> "Currently, only HTTPs clients perform out-of-band protocol fallback."
> [2], I can confirm what you're hinting at.
>
> Browsers are not the only client-side applications that implement
> "protocol fallback". The below transcript shows an MITM-triggered
> Thunderbird 24.7.0 IMAPS protocol downgrade to SSLv3 even though both
> peers speak TLSv1.
>
> --mancha
>
> [1] http://nmav.gnutls.org/2014/10/what-about-poodle.html
> [2] https://access.redhat.com/node/1232123
>
> ========= transcript ============
> Setting up mancha-in-the-middle...
>
> 127.0.0.1:44366 -> 127.0.0.1:993
> handshake               [tls1.0]        (client_hello)
>
> Start protocol downgrade attack...
>
> 127.0.0.1:44371 -> 127.0.0.1:993
> handshake               [ssl3.0]        (client_hello)
>
> 127.0.0.1:993 -> 127.0.0.1:44371
> handshake               [ssl3.0]        (server_hello)
> handshake               [ssl3.0]        (certificate)
> handshake               [ssl3.0]        (server_key_exchange)
> handshake               [ssl3.0]        (server_hello_done)
>
> 127.0.0.1:44371 -> 127.0.0.1:993
> handshake               [ssl3.0]        (client_key_exchange)
> change_cipher_spec      [ssl3.0]
> handshake               [ssl3.0]        (encrypted)
>
> 127.0.0.1:993 -> 127.0.0.1:44371
> change_cipher_spec      [ssl3.0]
> handshake               [ssl3.0]        (encrypted)
>
> 127.0.0.1:993 -> 127.0.0.1:44371
> application_data        [ssl3.0]
> application_data        [ssl3.0]
> =================================

-- 
Sent fron my mobile. Please excuse my brevity.