0

I'm working on remediation for some penetration testing we had done.

The penetration test reports a POODLE vulnerability due to SSv3 being enabled.

However, in the VirtualHost definition of my httpd.conf, I have:

<VirtualHost *:443>
     ServerAdmin [email protected]
     ServerName myhost.com
     SSLEngine On
     SSLProtocol all -SSLv2 -SSLv3
     SSLCertificateFile "/etc/httpd/ssl/e98c5d5c622256c1.crt"
     SSLCertificateKeyFile "/etc/httpd/ssl/myhost.key"
     SSLCertificateChainFile "/etc/httpd/ssl/gd_bundle-g2-g1.crt"
     RedirectMatch ^(.*)$ https://myhost.com/ords/f?p=1000:15
     RewriteEngine On
     RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
     RewriteRule .* - [F]
</VirtualHost>

Clearly, I have -SSLv3 in the SSLProtocol line above, and everything I've read says that if I disable SSLv3, I won't be subject to the POODLE attack.

But I've tried Qualys online SSL tester, and an 'ssl-poodle' nmap script, both of which tell me I'm still vulnerable.

Help?

Can anyone explain what I've missed here?

Thanks!

Update: This is on Oracle Linux 7.3, with Apache/2.4.6

5
  • Possible duplicate of Unable to disable SSLv3 in Apache 2.4.18
    – Ramhound
    Commented Jan 4, 2018 at 21:35
  • 1
    Worth pointing out that TLSv1 is not considered secure either. You really should only have TLSv1.2+ enabled in 2018. Anyways update your question, to include what version of OpenSSL you are using, that is considered to be important information in a case like this.
    – Ramhound
    Commented Jan 4, 2018 at 21:36
  • 1
    Your problem is likely the lack of the SSLCipherSuite and the fact Qualys doesn't have any valid vTLSv1.1 only tests, which likely means your problem is your version of OpenSSL doesn't include TLSv1.2 by default. I would submit an answer to your specific question, but an existing answer, already explains the reason it doesn't work.
    – Ramhound
    Commented Jan 4, 2018 at 21:56
  • You could of course just cheat and using a more secure configuration.
    – Ramhound
    Commented Jan 4, 2018 at 21:58

1 Answer 1

0

Ok, I figured this out. Although I had the correct SSLProtocol statement in every VirtualHost definition in my /etc/httpd/conf/httpd.conf file, it's apparently required in the default VirtualHost definition in /etc/httpd/conf.d/ssl.conf.

Once I added it to ssl.conf, it started working.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .