POODLE attack

E737309

The POODLE attack is a cryptographic vulnerability that exploits weaknesses in SSL 3.0’s CBC mode to decrypt secure HTTPS communications.

All labels observed (2)

How this entity was disambiguated

Statements (49)

Predicate Object
instanceOf cryptographic attack
man-in-the-middle attack
padding oracle attack
transport layer security vulnerability
abbreviation POODLE
affectedSoftware web browsers that supported SSL 3.0
web servers that supported SSL 3.0
affectsProtocol SSL 3.0
TLS (when TLS is downgraded to SSL 3.0)
announcedBy Bodo Möller
linked to: Paul Van Oorschot

Google security researchers
Krishna Bhargavan
Thai Duong
attackVector active network interception
induced repeated requests with controlled plaintext
category TLS/SSL vulnerability
web security vulnerability
CVEIdentifier CVE-2014-3566
disclosedOn 2014-10-14
enables decryption of parts of HTTPS traffic
recovery of authentication tokens
recovery of secure cookies
exploits CBC mode weaknesses in SSL 3.0
padding oracle in block cipher mode
fullName Padding Oracle On Downgraded Legacy Encryption
linked to: POODLE attack
impact confidentiality of encrypted data
integrity of secure cookies
session security of HTTPS websites
mitigation avoid protocol downgrades to SSL 3.0
disable SSL 3.0 support on clients
disable SSL 3.0 support on servers
implement TLS_FALLBACK_SCSV
use modern TLS versions only
namedAfter poodle (dog breed)
publishedIn Security Advisory by Google
reasonForName acronym for Padding Oracle On Downgraded Legacy Encryption
relatedTo BEAST attack
Lucky Thirteen attack
linked to: BEAST attack

protocol downgrade attacks
requires ability to trigger multiple HTTPS requests by the victim
man-in-the-middle network position
support for SSL 3.0 on client and server
securityPropertyViolated confidentiality of TLS/SSL sessions
standardResponse deprecation of SSL 3.0 in major browsers
removal of SSL 3.0 support from many servers
targets HTTPS connections
TLS/SSL sessions that can be downgraded to SSL 3.0
encrypted web traffic
vulnerableCipherMode CBC (Cipher Block Chaining)

How these facts were elicited

Referenced by (2)

Full triples — surface form annotated when it differs from this entity's canonical label.

BEAST attack relatedTo POODLE attack
POODLE attack fullName Padding Oracle On Downgraded Legacy Encryption
linked to: POODLE attack