Security Advisories

FSC-2014-8: Notice on SSL 3.0 "POODLE" Vulnerability

Description

An attack against CBC-mode ciphers in SSL 3.0 can be exploited by an active man-in-the-middle attacker by forcing a downgrade from TLS to SSL 3.0.

Security advisory: https://www.openssl.org/~bodo/ssl-poodle.pdf

Affected Products

Risk Level: MEDIUM (Low/Medium/High/Critical)

Corporate Products

  • F-Secure Messaging Security Gateway 7.1, 7.2 and 7.5
  • F-Secure Protection Service for Email 7.1, 7.2 and 7.5
  • F-Secure Server Security / Email and Server Security 10.x and 11.x
  • F-Secure PSB Server Security / PSB Email and Server Security 10.00
  • F-Secure Linux Security

Consumer Products

  • Safe Anywhere for PC
  • Safe Anywhere for MAC
  • F-Secure Freedome
  • F-Secure Key

More Information

POODLE stands for Padding Oracle On Downgraded Legacy Encryption. The vulnerability allows a man-in-the-middle attacker to decrypt cipher text using a padding oracle side-channel attack and affects SSL 3.0. This vulnerability does not affect the TLS encryption mechanism. Successful exploitation could lead to information disclosure by recovering small amounts of plaintext from an encrypted SSL 3.0 connection. CVE-2014-3566 has been assigned for this vulnerability.

This advisory will be updated as more information becomes available.
 

Mitigating Factors

  • The attacker must make several hundred HTTPS requests before the attack could be successful.
  • TLS 1.0, TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected.
     

Note: Products and platforms not listed in this advisory are NOT affected by POODLE.

Affected and Patched

The following products / platforms are affected and are already patched.

Product/Platform Remarks
F-SECURE MESSAGING SECURITY GATEWAY 7.1 – 7.5 1. Verify that patch has been installed in the appliance.
2. MSG 7.1 – Patch 2092
    MSG 7.2 – Patch 2093
    MSG 7.5 – Patch 2094
F-SECURE PROTECTION SERVICE FOR EMAIL 7.1 – 7.5 1. Verify that patch has been installed in the appliance.
2. PSE 7.1 – Patch 2092
    PSE 7.2 – Patch 2093
    PSE 7.5 – Patch 2094
SAFE ANYWHERE FOR PC 1. The client only creates connections at its own initiative, not controllable by a man-in-the-middle attacker. No patch is required for this product.
SAFE ANYWHERE FOR MAC 1. The client only creates connections at its own initiative, not controllable by a man-in-the-middle attacker. No patch is required for this product.
F-SECURE FREEDOME 1. F-Secure Freedome servers has been updated to disable SSL 3.0 encryption protocol.
F-SECURE KEY 1. F-Secure Key servers has been updated to disable SSL 3.0 encryption protocol.

Affected, Requires User Action

The following products are affected and require user interaction.

Product/Platform Remarks
F-SECURE SERVER SECURITY 1. Manually disable SSL 3.0 from the browser.
2. Detailed guidance can be found here:
    Guidance for disabling SSL 3.0 in browsers (PDF)
F-SECURE EMAIL AND SERVER SECURITY 1. Manually disable SSL 3.0 from the browser.
2. Detailed guidance can be found here:
    Guidance for disabling SSL 3.0 in browsers (PDF)
F-SECURE PSB SERVER SECURITY 1. Manually disable SSL 3.0 from the browser.
2. Detailed guidance can be found here:
    Guidance for disabling SSL 3.0 in browsers (PDF)
F-SECURE PSB EMAIL AND SERVER SECURITY 1. Manually disable SSL 3.0 from the browser.
2. Detailed guidance can be found here:
    Guidance for disabling SSL 3.0 in browsers (PDF)
F-SECURE LINUX SECURITY 1. Manually disable SSL 3.0 usage from the product.
2. Detailed guidance can be found here:
    Guidance for disabling SSL 3.0 in Linux Security (PDF)

Advisory Changes

Date Changes
24 October 2014 F-Secure Search and Safe Avenue removed as they do not use SSL3.0 by default and are thus not affected.
Updated Safe Anywhere for PC remark for clarification.
23 October 2014 First advisory published.

Date Issued: 2014-10-23
Date Last Updated: 2014-10-24

Get Support

For documentation and product support, visit our Support site.

Go Support

F-Secure Community

Give advice. Get advice. Share the knowledge on our free discussion forum.

Go Community