Quantcast
Channel: THWACK: Message List
Viewing all articles
Browse latest Browse all 20625

Re: Is Serv-U vulnerable to POODLE SSLv3 Exploit?

$
0
0

POODLE is MITM attack exploited when the client & server use a CBC cipher during an SSLv3 session.  What makes this more dangerous is that the MITM can force the client & server to use SSLv3 even if they both support TLS (and would normally negotiate a TLS session) through another "attack".  For applications that don't currently support disabling SSLv3, a very temporary workaround would be to disable all CBC ciphers in the application.  While RC4 isn't impervious to attacks either, as I said, it's temporary.

 

So what you're saying is true.  If Serv-U is configured in this manner and the client attempting to connect doesn't allow RC4, then the negotiation will fail.


Viewing all articles
Browse latest Browse all 20625

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>