OSSN-0039: Configuring OpenStack deployments to prevent POODLE attacks

Summary

POODLE (CVE-2014-3566) is a new attack on SSLv3 that allows an active network-based attacker to recover the plaintext from a secure connection using a CBC-mode cipher. Unfortunately, all other cipher modes in SSLv3 are also insecure. Therefore, the recommended solution is to disable SSLv3. We also discuss an alternative option below. Proper mitigation requires addressing this issue on SSLv3 clients and servers.

Affected Services / Software

Any service using SSLv3. Depending on the backend SSL library, this can include many components of an OpenStack cloud:

  • OpenStack services

  • OpenStack clients

  • Web servers (Apache, Nginx, etc)

  • SSL/TLS terminators (Stud, Pound, etc)

  • Proxy services (HAProxy, etc)

  • Miscellaneous services (eventlet, syslog, ldap, smtp, etc)

Discussion

The POODLE attack was first announced on 14 Oct 2014. For a deeper technical discussion on POODLE, we refer you to the security advisory at openssl.org and Daniel Franke’s write-up. POODLE affects any SSL/TLS connection that can be downgraded to SSLv3. This requires both the client and the server to support SSLv3. Due to the way the protocol negotiations work, an attacker positioned on the network between the client and the server can force a downgrade to SSLv3 by selectively dropping network packets.

The best remediation for POODLE is to disable SSLv3 on all clients and servers that you control. This will protect you regardless of the mitigation status on the other end of the connection. An alternative option is to deploy TLS_FALLBACK_SCSV, which will prevent the downgrade attack, but could still allow SSLv3 connections if that is the only supported protocol between the client and server.

You can use the OpenSSL s_client tool to test if a server allows SSLv3 connections:

openssl s_client -connect <domain name>:<port> -ssl3

If the server does not support SSLv3, you will see a handshake failure message. This indicates that the server does not accept SSLv3 connections. Assuming this server also has SSLv2 disabled, which is a common default today, then no further configuration is needed. If the handshake from s_client completes, then the server requires some configuration. Note that you can perform this step for any service that has SSL/TLS enabled including OpenStack API endpoints.

Testing clients is slightly more cumbersome. Using the OpenSSL s_server tool, you can create an endpoint that only accepts SSLv3:

openssl s_server -cert <filename> -key <filename> -state -ssl3 -no_ssl2 -no_tls1 -no_tls1_1 -no_tls1_2 -tlsextdebug

If the client can connect to this endpoint, the client needs to update their configuration as described below.

Contacts / References

Author: Bryan D. Payne, Nebula