POODLE

Last updated

POODLE
CVE identifier(s) CVE-2014-3566
Date discoveredOctober 14, 2014;9 years ago (2014-10-14)
DiscovererBodo Möller, Thai Duong, Krzysztof Kotowicz (Google Security Team)
Affected softwareAny software that uses or supports a fallback to SSL 3.0

POODLE (which stands for "Padding Oracle On Downgraded Legacy Encryption") is a security vulnerability which takes advantage of the fallback to SSL 3.0. [1] [2] [3] If attackers successfully exploit this vulnerability, on average, they only need to make 256 SSL 3.0 requests to reveal one byte of encrypted messages. Bodo Möller, Thai Duong and Krzysztof Kotowicz from the Google Security Team discovered this vulnerability; they disclosed the vulnerability publicly on October 14, 2014 (despite the paper being dated "September 2014" [1] ). [4] On December 8, 2014, a variation of the POODLE vulnerability that affected TLS was announced. [5]

Contents

The CVE-ID associated with the original POODLE attack is CVE - 2014-3566. F5 Networks filed for CVE - 2014-8730 as well, see POODLE attack against TLS section below.

Prevention

To mitigate the POODLE attack, one approach is to completely disable SSL 3.0 on the client side and the server side. However, some old clients and servers do not support TLS 1.0 and above. Thus, the authors of the paper on POODLE attacks also encourage browser and server implementation of TLS_FALLBACK_SCSV, [6] which will make downgrade attacks impossible. [1] [7]

Another mitigation is to implement "anti-POODLE record splitting". It splits the records into several parts and ensures none of them can be attacked. However the problem of the splitting is that, though valid according to the specification, it may also cause compatibility issues due to problems in server-side implementations. [8]

A full list of browser versions and levels of vulnerability to different attacks (including POODLE) can be found in the article Transport Layer Security.

Opera 25 implemented this mitigation in addition to TLS_FALLBACK_SCSV. [9]

Google's Chrome browser and their servers had already supported TLS_FALLBACK_SCSV. Google stated in October 2014 it was planning to remove SSL 3.0 support from their products completely within a few months. [7] Fallback to SSL 3.0 has been disabled in Chrome 39, released in November 2014. [10] SSL 3.0 has been disabled by default in Chrome 40, released in January 2015. [11]

Mozilla disabled SSL 3.0 in Firefox 34 and ESR 31.3, which were released in December 2014, and added support of TLS_FALLBACK_SCSV in Firefox 35. [12]

Microsoft published a security advisory to explain how to disable SSL 3.0 in Internet Explorer and Windows OS, [13] and on October 29, 2014, Microsoft released a fix which disables SSL 3.0 in Internet Explorer on Windows Vista / Server 2003 and above and announced a plan to disable SSL 3.0 by default in their products and services within a few months. [14] Microsoft disabled fallback to SSL 3.0 in Internet Explorer 11 for Protect Mode sites on February 10, 2015, [15] and for other sites on April 14, 2015. [16]

Apple's Safari (on OS X 10.8, iOS 8.1 and later) mitigated against POODLE by removing support for all CBC protocols in SSL 3.0, [17] [18] however, this left RC4 which is also completely broken by the RC4 attacks in SSL 3.0.[ citation needed ] POODLE was completely mitigated in OS X 10.11 (El Capitan 2015) and iOS 9 (2015).

To prevent the POODLE attack, some web services dropped support of SSL 3.0. Examples include CloudFlare [19] and Wikimedia. [20]

Network Security Services version 3.17.1 (released on October 3, 2014) and 3.16.2.3 (released on October 27, 2014) introduced support for TLS_FALLBACK_SCSV, [21] [22] and NSS will disable SSL 3.0 by default in April 2015. [23] [ needs update ] OpenSSL versions 1.0.1j, 1.0.0o and 0.9.8zc, released on October 15, 2014, introduced support for TLS_FALLBACK_SCSV. [24] LibreSSL version 2.1.1, released on October 16, 2014, disabled SSL 3.0 by default. [25]

POODLE attack against TLS

A new variant of the original POODLE attack was announced on December 8, 2014. This attack exploits implementation flaws of CBC encryption mode in the TLS 1.0 - 1.2 protocols. Even though TLS specifications require servers to check the padding, some implementations fail to validate it properly, which makes some servers vulnerable to POODLE even if they disable SSL 3.0. [5] SSL Pulse showed "about 10% of the servers are vulnerable to the POODLE attack against TLS" before this vulnerability was announced. [26] The CVE-ID for F5 Networks' implementation bug is CVE - 2014-8730. The entry in NIST's NVD states that this CVE-ID is to be used only for F5 Networks' implementation of TLS, and that other vendors whose products have the same failure to validate the padding mistake in their implementations like A10 Networks and Cisco Systems need to issue their own CVE-IDs for their implementation errors because this is not a flaw in the protocol but in the implementation.

The POODLE attack against TLS was found to be easier to initiate than the initial POODLE attack against SSL. There is no need to downgrade clients to SSL 3.0, meaning fewer steps are needed to execute a successful attack. [27]

Related Research Articles

<span class="mw-page-title-main">HTTPS</span> Extension of the HTTP communications protocol to support TLS encryption

Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.

Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securing HTTPS remains the most publicly visible.

<span class="mw-page-title-main">OpenSSL</span> Open-source implementation of the SSL and TLS protocols

OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites.

Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport—the application does not suffer from the delays associated with stream protocols, but because it uses User Datagram Protocol (UDP) or Stream Control Transmission Protocol (SCTP), the application has to deal with packet reordering, loss of datagram and data larger than the size of a datagram network packet. Because DTLS uses UDP or SCTP rather than TCP it avoids the TCP meltdown problem when being used to create a VPN tunnel.

<span class="mw-page-title-main">Network Security Services</span> Collection of cryptographic computer libraries

Network Security Services (NSS) is a collection of cryptographic computer libraries designed to support cross-platform development of security-enabled client and server applications with optional support for hardware TLS/SSL acceleration on the server side and hardware smart cards on the client side. NSS provides a complete open-source implementation of cryptographic libraries supporting Transport Layer Security (TLS) / Secure Sockets Layer (SSL) and S/MIME. NSS releases prior to version 3.14 are tri-licensed under the Mozilla Public License 1.1, the GNU General Public License, and the GNU Lesser General Public License. Since release 3.14, NSS releases are licensed under GPL-compatible Mozilla Public License 2.0.

The Online Certificate Status Protocol (OCSP) stapling, formally known as the TLS Certificate Status Request extension, is a standard for checking the revocation status of X.509 digital certificates. It allows the presenter of a certificate to bear the resource cost involved in providing Online Certificate Status Protocol (OCSP) responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the CA, with the aim of improving both security and performance.

Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. The extension allows a server to present one of multiple possible certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites to be served by the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP/1.1 name-based virtual hosting, but for HTTPS. This also allows a proxy to forward client traffic to the right server during TLS/SSL handshake. The desired hostname is not encrypted in the original SNI extension, so an eavesdropper can see which site is being requested. The SNI extension was specified in 2003 in RFC 3546

SPDY is an obsolete open-specification communication protocol developed for transporting web content. SPDY became the basis for HTTP/2 specification. However, HTTP/2 diverged from SPDY and eventually HTTP/2 subsumed all usecases of SPDY. After HTTP/2 was ratified as a standard, major implementers, including Google, Mozilla, and Apple, deprecated SPDY in favor of HTTP/2. Since 2021, no modern browser supports SPDY.

HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers should automatically interact with it using only HTTPS connections, which provide Transport Layer Security (TLS/SSL), unlike the insecure HTTP used alone. HSTS is an IETF standards track protocol and is specified in RFC 6797.

A cipher suite is a set of algorithms that help secure a network connection. Suites typically use Transport Layer Security (TLS) or its deprecated predecessor Secure Socket Layer (SSL). The set of algorithms that cipher suites usually contain include: a key exchange algorithm, a bulk encryption algorithm, and a message authentication code (MAC) algorithm.

The Transport Layer Security (TLS) protocol provides the ability to secure communications across or inside networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free software and open source.

In cryptography, a padding oracle attack is an attack which uses the padding validation of a cryptographic message to decrypt the ciphertext. In cryptography, variable-length plaintext messages often have to be padded (expanded) to be compatible with the underlying cryptographic primitive. The attack relies on having a "padding oracle" who freely responds to queries about whether a message is correctly padded or not. The information could be directly given, or leaked through a side-channel.

Application-Layer Protocol Negotiation (ALPN) is a Transport Layer Security (TLS) extension that allows the application layer to negotiate which protocol should be performed over a secure connection in a manner that avoids additional round trips and which is independent of the application-layer protocols. It is used to establish HTTP/2 connections without additional round trips.

<span class="mw-page-title-main">Heartbleed</span> Security bug in OpenSSL

Heartbleed is a security bug in some outdated versions of the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed could be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or client. It resulted from improper input validation in the implementation of the TLS heartbeat extension. Thus, the bug's name derived from heartbeat. The vulnerability was classified as a buffer over-read, a situation where more data can be read than should be allowed.

<span class="mw-page-title-main">LibreSSL</span> Open-source implementation of TLS protocols; forked from OpenSSL in 2014

LibreSSL is an open-source implementation of the Transport Layer Security (TLS) protocol. The implementation is named after Secure Sockets Layer (SSL), the deprecated predecessor of TLS, for which support was removed in release 2.3.0. The OpenBSD project forked LibreSSL from OpenSSL 1.0.1g in April 2014 as a response to the Heartbleed security vulnerability, with the goals of modernizing the codebase, improving security, and applying development best practices.

FREAK is a security exploit of a cryptographic weakness in the SSL/TLS protocols introduced decades earlier for compliance with U.S. cryptography export regulations. These involved limiting exportable software to use only public key pairs with RSA moduli of 512 bits or fewer, with the intention of allowing them to be broken easily by the National Security Agency (NSA), but not by other organizations with lesser computing resources. However, by the early 2010s, increases in computing power meant that they could be broken by anyone with access to relatively modest computing resources using the well-known Number Field Sieve algorithm, using as little as $100 of cloud computing services. Combined with the ability of a man-in-the-middle attack to manipulate the initial cipher suite negotiation between the endpoints in the connection and the fact that the finished hash only depended on the master secret, this meant that a man-in-the-middle attack with only a modest amount of computation could break the security of any website that allowed the use of 512-bit export-grade keys. While the exploit was only discovered in 2015, its underlying vulnerabilities had been present for many years, dating back to the 1990s.

A downgrade attack, also called a bidding-down attack, or version rollback attack, is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation in favor of an older, lower-quality mode of operation that is typically provided for backward compatibility with older systems. An example of such a flaw was found in OpenSSL that allowed the attacker to negotiate the use of a lower version of TLS between the client and server. This is one of the most common types of downgrade attacks. Opportunistic encryption protocols such as STARTTLS are generally vulnerable to downgrade attacks, as they, by design, fall back to unencrypted communication. Websites which rely on redirects from unencrypted HTTP to encrypted HTTPS can also be vulnerable to downgrade attacks, as the initial redirect is not protected by encryption.

Logjam is a security vulnerability in systems that use Diffie–Hellman key exchange with the same prime number. It was discovered by a team of computer scientists and publicly reported on May 20, 2015. The discoverers were able to demonstrate their attack on 512-bit DH systems. They estimated that a state-level attacker could do so for 1024-bit systems, then widely used, thereby allowing decryption of a significant fraction of Internet traffic. They recommended upgrading to at least 2048 bits for shared prime systems.

<span class="mw-page-title-main">DROWN attack</span> Security bug

The DROWN attack is a cross-protocol security bug that attacks servers supporting modern SSLv3/TLS protocol suites by using their support for the obsolete, insecure, SSL v2 protocol to leverage an attack on connections using up-to-date protocols that would otherwise be secure. DROWN can affect all types of servers that offer services encrypted with SSLv3/TLS yet still support SSLv2, provided they share the same public key credentials between the two protocols. Additionally, if the same public key certificate is used on a different server that supports SSLv2, the TLS server is also vulnerable due to the SSLv2 server leaking key information that can be used against the TLS server.

Version history for TLS/SSL support in web browsers tracks the implementation of Transport Layer Security protocol versions in major web browsers.

References

  1. 1 2 3 Möller, Bodo; Duong, Thai; Kotowicz, Krzysztof (September 2014). "This POODLE Bites: Exploiting The SSL 3.0 Fallback" (PDF).
  2. ↑ Bright, Peter (October 15, 2014). "SSL broken, again in POODLE attack". Ars Technica.
  3. ↑ Brandom, Russell (October 14, 2014). "Google researchers reveal new Poodle bug, putting the web on alert".
  4. ↑ "Google Online Security Blog: This POODLE bites: exploiting the SSL 3.0 fallback". Google Online Security Blog. Retrieved June 1, 2015.
  5. 1 2 Langley, Adam (December 8, 2014). "The POODLE bites again" . Retrieved December 8, 2014.
  6. ↑ B. Moeller, A. Langley (April 2015). "RFC 7507: TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks". IETF. doi: 10.17487/RFC7507 .{{cite journal}}: Cite journal requires |journal= (help)
  7. 1 2 Möller, Bodo (October 14, 2014). "This POODLE bites: exploiting the SSL 3.0 fallback". Google Online Security blog. Google (via Blogspot). Retrieved October 15, 2014.
  8. ↑ Langley, Adam (October 14, 2014). "POODLE attacks on SSLv3". imperialviolet.org. Retrieved October 16, 2014.
  9. ↑ Molland, Håvard (October 15, 2014). "Security changes in Opera 25; the poodle attacks". Opera security blog. Opera . Retrieved October 16, 2014.
  10. ↑ Ilascu, Ionut. "Chrome 39 Disables SSLv3 Fallback, Awards $41,500 / €33,000 in Bounties". Softpedia. Retrieved December 3, 2014.
  11. ↑ "Issue 693963003: Add minimum TLS version control to about:flags and Finch gate it". Chromium Code Reviews. Retrieved April 16, 2015.
  12. ↑ "The POODLE Attack and the End of SSL 3.0". Mozilla blog. Mozilla. October 14, 2014. Retrieved October 15, 2014.
  13. ↑ "Vulnerability in SSL 3.0 Could Allow Information Disclosure". Microsoft TechNet. Microsoft. October 14, 2014. Retrieved October 15, 2014.
  14. ↑ "Security Advisory 3009008 revised". Microsoft TechNet. Microsoft. October 29, 2014. Retrieved October 30, 2014.
  15. ↑ Oot, Alec (December 9, 2014). "December 2014 Internet Explorer security updates & disabling SSL 3.0 fallback". Microsoft. Retrieved December 9, 2014.
  16. ↑ "February 2015 security updates for Internet Explorer". IEBlog. April 14, 2015. Retrieved April 15, 2015.
  17. ↑ "About Security Update 2014-005". apple.com. Retrieved June 1, 2015.
  18. ↑ "About the security content of iOS 8.1". apple.com. Retrieved June 1, 2015.
  19. ↑ Prince, Matthew (October 14, 2014). "SSLv3 Support Disabled By Default Due to POODLE Vulnerability". Cloudflare blog. Cloudflare. Retrieved October 15, 2014.
  20. ↑ Bergsma, Mark (October 17, 2014). "Protecting users against POODLE by removing SSL 3.0 support". Wikimedia blog. Wikimedia Foundation. Retrieved October 17, 2014.
  21. ↑ "NSS 3.17.1 release notes". Mozilla. October 3, 2014. Archived from the original on April 19, 2019. Retrieved October 27, 2014.
  22. ↑ "NSS 3.16.2.3 release notes". Mozilla. October 27, 2014. Archived from the original on April 19, 2019. Retrieved October 27, 2014.
  23. ↑ "Disable SSL 3 by default in NSS in April 2015". mozilla.dev.tech.crypto. October 27, 2014. Retrieved October 27, 2014.
  24. ↑ "OpenSSL Security Advisory [15 Oct 2014]". OpenSSL. October 15, 2014. Retrieved October 20, 2014.
  25. ↑ "LibreSSL 2.1.1 released". LibreSSL. October 16, 2014. Retrieved October 20, 2014.
  26. ↑ Ristic, Ivan (December 8, 2014). "Poodle Bites TLS" . Retrieved December 8, 2014.
  27. ↑ Stosh, Brandon (December 8, 2014). "Nasty POODLE Variant Bypasses TLS Crypto Affecting Over 10 Percent of the Web" . Retrieved December 8, 2014.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.