Slashdot Mirror
POODLE Flaw Returns, This Time Hitting TLS Protocol
angry tapir writes: If you patched your sites against a serious SSL flaw discovered in October you will have to check them again. Researchers have discovered that the POODLE vulnerability also affects implementations of the newer TLS protocol. The POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability allows attackers who manage to intercept traffic between a user's browser and an HTTPS website to decrypt sensitive information, like the user's authentication cookies.
The article references the SSL Labs tool which includes the TLS POODLE test: https://www.ssllabs.com/ssltes...
Don't you mean Dog shit instead of bullshit? After all, this is a POODLE vulnerability.
Be seeing you...
GP asked for this:
Can't anybody just post the damn direct link to the fucking advisory or source articles anymore.
Disabling Javascript isn't going to help with that.
systemd is Roko's Basilisk.
Have you considered upgrading your browser!
For those of us who are stuck using older browsers (FireFox v10 or IE6), even with SSL disabled and only TLS 1.0 enabled, will this be a problem?
As I said, stuck. I won't appreciate replies saying to upgrade my browser.
Yes, in fact it is ONLY you who are affected. This was discovered in old versions of NSS, which means old Firefox and Chromium versions.
If there were a just and caring God, he would never let geeks name things.
POODLE?
Jesus wept. Literally. He heard the name and wept tears.
Geeks made baby Jesus cry.
Crumb's Corollary: Never bring a knife to a bun fight.
You should consider NCSA Mosaic. I can guarantee that it is not vulnerable to any flaws SSL or TLS.
I don't know his exact situation, but it's possible that the company he works at has an app that only works with IE6. There used to be many apps like this.
If this is such a case, the fuckwad is the company (for not hiring developers to upgrade the app) or the vendor that supplies the app without upgrading it (Maybe the company is still to blame for not moving to a more current product, or maybe there isn't one). Either way, the user that is forced to stick with the crappy browser is not necessarily the problem.
Though he might be! :) - Rather than assuming and bashing, we should answer the question... Oh wait. Slashdot :)
Hi! You must be new here. The most points that were most likely spent on him is 1. You see, it's only AC's like us that read as 0 out the gate. For registered users they normally start out at 1... unless they have an "Excellent" karma rating, which means they've made a significant number of posts that have been modded up, then a registered user will start out of the gate at a 2 before any mods are made. Looking at Mr. Nyder's posting profile, this is not outside of the realm of possibility. So It's very possible that no one wasted any points of Karma...thus, you're the only frickin retard in the bloody room ya frickin Limey!
You must be new here.
I love my sig.
For those of us who are stuck using older browsers (FireFox v10 or IE6), even with SSL disabled and only TLS 1.0 enabled, will this be a problem?
As I said, stuck. I won't appreciate replies saying to upgrade my browser.
In IE 6.0, you can enable TLS 1.0. It is not on by default.
It is deep in the "Internet Settings" in "Security". Scroll down the list and find where it mentions TLS.
IE 6.0 does not do TLS 1.1 or later, so when TLS 1.0 gets shut off, you are done with it.
I believe RC4 is only in SSL 3.0 so that being on or off doesn't matter.
PS, most sites already have 3.0 off, so you may be in the clear already.
don't know his exact situation, but it's possible that the company he works at has an app that only works with IE6. There used to be many apps like this.
That's no excuse! IE6 belongs in a VM used only for internal sites and strictly firewalled off from the outside world. But even if you're stuck with IE6, at least run the latest FF or something beside it.
Socialism: a lie told by totalitarians and believed by fools.
The CVE for this has already been rejected. There was an implementation problem on a specific piece of network equipment and not a general TLS implementation issue
Link?
Unless your company/vendor forces you to use it externally, or will not provide said VM for internal sites.
I'm not agreeing that it's OK to use such a browser, just saying that it's not necessarily the users own fault. Companies can be idiots too when it comes to IT security.
Not to feed the trolls more but... did you know that if you are logged in you can click the comment score and SEE all the moderation on the comment?
At the current time, the post in question started at 2 and has +1 Funny for a total of 3.
If you are logged in, you can also change the weight of users to remove the karma bonus.
https://www.imperialviolet.org...
This affects BigIP F5 and A10 load balancers which implement TLS incorrectly.
This affects BigIP F5 and A10 load balancers which implement TLS incorrectly.
Proper grouping: ((BigIP F5) and (A10)) (load balancers).
Anyone who doesn't irrationally hate Apple have any tips, suggestions for fixing this? I'm still using OS X 10.7 so maybe my best bet is to upgrade the OS, but would like to avoid doing so to keep some older programs running.
http://www.acetonestudio.com
It is very important to understand that this is a flaw in some vendors' TLS implementation, NOT in the tls protocol itself.