Slashdot Mirror
POODLE Flaw Returns, This Time Hitting TLS Protocol
angry tapir writes: If you patched your sites against a serious SSL flaw discovered in October you will have to check them again. Researchers have discovered that the POODLE vulnerability also affects implementations of the newer TLS protocol. The POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability allows attackers who manage to intercept traffic between a user's browser and an HTTPS website to decrypt sensitive information, like the user's authentication cookies.
The article references the SSL Labs tool which includes the TLS POODLE test: https://www.ssllabs.com/ssltes...
Don't you mean Dog shit instead of bullshit? After all, this is a POODLE vulnerability.
Be seeing you...
https://www.imperialviolet.org/2014/12/08/poodleagain.html
Just disable Javascript. No jumps (OK, sometimes no sites, but I just don't see what I don't see: the worst offenders get winnowed out for me, so to speak).
No, I mean you're a pile of silly horse shit and whoever spent 2 points worth of karma on you is a frickin retard.
GP asked for this:
Can't anybody just post the damn direct link to the fucking advisory or source articles anymore.
Disabling Javascript isn't going to help with that.
systemd is Roko's Basilisk.
I consider these annoying Javascript sites to be part of the Dark Net. I simply don't see them.
For those of us who are stuck using older browsers (FireFox v10 or IE6), even with SSL disabled and only TLS 1.0 enabled, will this be a problem?
As I said, stuck. I won't appreciate replies saying to upgrade my browser.
> Disabling Javascript isn't going to help with that.
Correct. But it helps with the jump. That some try (and partly suceed) in making /. into a clickbait farm is sad and not a technical problem.
If there were a just and caring God, he would never let geeks name things.
POODLE?
Jesus wept. Literally. He heard the name and wept tears.
Geeks made baby Jesus cry.
Crumb's Corollary: Never bring a knife to a bun fight.
The impact of this problem is similar to that of POODLE, with the attack being slightly easier to execute–no need to downgrade modern clients down to SSL 3 first, TLS 1.2 will do just fine.
This seems like a good moment to reiterate that everything less than TLS 1.2 with an AEAD cipher suite is cryptographically broken. An IETF draft to prohibit RC4 is in Last Call at the moment but it would be wrong to believe that RC4 is uniquely bad. While RC4 is fundamentally broken and no implementation can save it, attacks against MtE-CBC ciphers have repeatedly been shown to be far more practical. Thankfully, TLS 1.2 support is about to hit 50% at the time of writing.
I am terribly confused. Is or isn't worth upgrading to TLS 1.2?
I am stuck with TLS 1.0 on FireFox v10 ESR. Tried v24, and it's just ick with the one of the bugs that I 'first' encounted with v17 with my "setup". "Up and down shaking" with my tab 'setup' if you're curious. I use two rows of tabs. And v31 is totally broken in a frustrating way. I may be able to manage v24 if I'm forced to, but I don't want to upgrade if I don't have to. (I wish Mozilla would just do security patches for all the ESRs. Not bug patches, but security patches. Wasn't that the point of having an ESR with which to begin?)
tl;dr For those of us on TLS 1.0, do we need to do anything, or is it something only server/website admins need to do?
The CVE for this has already been rejected. There was an implementation problem on a specific piece of network equipment and not a general TLS implementation issue
If he's running IE 6, upgrading may not be an option. He may need it for websites that will only work in it. Even if he does upgrade, he may only be able to upgrade to IE 8, which isn't much of an improvement.
And he surely can't upgrade Firefox. Firefox has gotten progressively worse since Firefox 10. Firefox 29, for example, brings in the Australis UI which is absolutely unusable. Firefox 33.1 brings in "sponsored tiles" (in-browser advertisements). And those are just two among many fuck-ups that Mozilla has forced upon Firefox users.
The Firefox situation is particularly sad. Mozilla has forced Firefox users to forgo security updates in order for these same users to retain a quasi-usable UI. I'm sure a lot of them would like to upgrade to get the security fixes. But it's hard to justify upgrading to avoid obscure security issues that will likely never be triggered, if it also means being constantly subjected to an unusable, broken UI from then on.
static html wth blink tags was good enough for my grandfather so its good enough for me.
Hi! You must be new here. The most points that were most likely spent on him is 1. You see, it's only AC's like us that read as 0 out the gate. For registered users they normally start out at 1... unless they have an "Excellent" karma rating, which means they've made a significant number of posts that have been modded up, then a registered user will start out of the gate at a 2 before any mods are made. Looking at Mr. Nyder's posting profile, this is not outside of the realm of possibility. So It's very possible that no one wasted any points of Karma...thus, you're the only frickin retard in the bloody room ya frickin Limey!
You must be new here.
I love my sig.
Not to feed the trolls more but... did you know that if you are logged in you can click the comment score and SEE all the moderation on the comment?
At the current time, the post in question started at 2 and has +1 Funny for a total of 3.
If you are logged in, you can also change the weight of users to remove the karma bonus.
Adam Langley of Google found the POODLE-with-TLS issue and started informing people:
https://www.imperialviolet.org/2014/12/08/poodleagain.html
Basically:
The POODLE attack leverage some weaknesses in how SSL 3 did padding of its packets. There was no easy way to fix the protocol, so the recommended way to deal with it was to disable SSL 3. However it turns that the padding function in TLS is a sub-set of SSL 3, so a lot of software simply re-uses it for both protocols. This allows the POODLE attack to be done against padding in TLS as well.
The issue is that some of this software is common load balancer software, which sits in from of many things.
Anyone who doesn't irrationally hate Apple have any tips, suggestions for fixing this? I'm still using OS X 10.7 so maybe my best bet is to upgrade the OS, but would like to avoid doing so to keep some older programs running.
http://www.acetonestudio.com
It is very important to understand that this is a flaw in some vendors' TLS implementation, NOT in the tls protocol itself.