POODLE attack

E737309

The POODLE attack is a cryptographic vulnerability that exploits weaknesses in SSL 3.0’s CBC mode to decrypt secure HTTPS communications.

All labels observed (2)

How this entity was disambiguated

Statements (49)

Predicate Object
instanceOf cryptographic attack ⓘ
man-in-the-middle attack ⓘ
padding oracle attack ⓘ
transport layer security vulnerability ⓘ
abbreviation POODLE ⓘ
affectedSoftware web browsers that supported SSL 3.0 ⓘ
web servers that supported SSL 3.0 ⓘ
affectsProtocol SSL 3.0 ⓘ
TLS (when TLS is downgraded to SSL 3.0) ⓘ
announcedBy Bodo Möller ⓘ
linked to: Paul Van Oorschot

Google security researchers ⓘ
Krishna Bhargavan ⓘ
Thai Duong ⓘ
attackVector active network interception ⓘ
induced repeated requests with controlled plaintext ⓘ
category TLS/SSL vulnerability ⓘ
web security vulnerability ⓘ
CVEIdentifier CVE-2014-3566 ⓘ
disclosedOn 2014-10-14 ⓘ
enables decryption of parts of HTTPS traffic ⓘ
recovery of authentication tokens ⓘ
recovery of secure cookies ⓘ
exploits CBC mode weaknesses in SSL 3.0 ⓘ
padding oracle in block cipher mode ⓘ
fullName Padding Oracle On Downgraded Legacy Encryption ⓘ
linked to: POODLE attack
impact confidentiality of encrypted data ⓘ
integrity of secure cookies ⓘ
session security of HTTPS websites ⓘ
mitigation avoid protocol downgrades to SSL 3.0 ⓘ
disable SSL 3.0 support on clients ⓘ
disable SSL 3.0 support on servers ⓘ
implement TLS_FALLBACK_SCSV ⓘ
use modern TLS versions only ⓘ
namedAfter poodle (dog breed) ⓘ
publishedIn Security Advisory by Google ⓘ
reasonForName acronym for Padding Oracle On Downgraded Legacy Encryption ⓘ
relatedTo BEAST attack ⓘ
Lucky Thirteen attack ⓘ
linked to: BEAST attack

protocol downgrade attacks ⓘ
requires ability to trigger multiple HTTPS requests by the victim ⓘ
man-in-the-middle network position ⓘ
support for SSL 3.0 on client and server ⓘ
securityPropertyViolated confidentiality of TLS/SSL sessions ⓘ
standardResponse deprecation of SSL 3.0 in major browsers ⓘ
removal of SSL 3.0 support from many servers ⓘ
targets HTTPS connections ⓘ
TLS/SSL sessions that can be downgraded to SSL 3.0 ⓘ
encrypted web traffic ⓘ
vulnerableCipherMode CBC (Cipher Block Chaining) ⓘ

How these facts were elicited

Referenced by (2)

Full triples — surface form annotated when it differs from this entity's canonical label.

BEAST attack → relatedTo → POODLE attack ⓘ
POODLE attack → fullName → Padding Oracle On Downgraded Legacy Encryption ⓘ
linked to: POODLE attack