| Linode Forum https://forum.linode.com/ |
|
| Why doesn't this work to fix POODLE in Dovecot 2.0? https://forum.linode.com/viewtopic.php?f=11&t=11371 |
Page 1 of 1 |
| Author: | dee4 [ Sun Oct 19, 2014 8:52 am ] |
| Post subject: | Why doesn't this work to fix POODLE in Dovecot 2.0? |
I'm on Ubuntu 12.04 and the latest version of Dovecot it has is 2.0.19. It doesn't go up to 2.1. According to https://www.linode.com/docs/security/se ... for-poodle there is no easy way to patch Dovecot 2.0 for Poodle (I supposedly have to change Dovecot's source code). According to another website https://zmap.io/sslv3/servers.html#dovecot this line should work for Dovecot 2.0: Code: ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL It makes a lot of sense. It also does seem to work, in the sense that "openssl s_client -connect mail.example.com:993 -ssl3" gives me the right output according to the above Linode doc. The problem is that my Mail.app client on OS X Yosemite can no longer connect to my mail server. Why is this? Is this a problem with the Dovecot fix, or is it a problem with Mail.app? |
|
| Author: | Main Street James [ Sun Oct 19, 2014 1:38 pm ] |
| Post subject: | Re: Why doesn't this work to fix POODLE in Dovecot 2.0? |
The problem is probably that Mail requires SSLv3. Read more, and check sites & ports, at: http://poodlebleed.com |
|
| Author: | dwfreed [ Sun Oct 19, 2014 4:09 pm ] |
| Post subject: | Re: Why doesn't this work to fix POODLE in Dovecot 2.0? |
TLS 1.0 and TLS 1.1 do not define any new ciphers, and so use the SSLv3 ciphers. Since you're disabling the SSLv3 ciphers, the only thing left is the TLS 1.2 ciphers. I don't have Yosemite yet, but Mavericks' Mail.app reports its highest supported TLS version is 1.0, even though the system crypto library supports TLS 1.2, which I found from dissecting the ClientHello in the TLS handshake. As a result, there are no ciphers the client supports in the server's provided cipher list, so the connection cannot continue. IIRC, Wireshark can dissect the TLS handshake, and tell you the client's maximum supported TLS version. If Yosemite's Mail.app is also showing TLS 1.0 or 1.1 as the maximum supported version, then your options are to patch Dovecot yourself (not fun), wait until Ubuntu has released a patched version of Dovecot for 12.04 (see https://bugs.launchpad.net/ubuntu/+sour ... ug/1381537), or update to 14.04 (there are a lot of changes, so this won't be a simple upgrade). |
|
| Author: | centminmod [ Sun Oct 19, 2014 9:20 pm ] |
| Post subject: | Re: Why doesn't this work to fix POODLE in Dovecot 2.0? |
what dwfreed said reason why -SSLv3 doesn't work at cipher level is because OpenSSL tags TLSv1 as SSLv3 ciphers https://community.centminmod.com/threads/poodle-attacks-on-sslv3-vulnerability.1651/page-3#post-8189. So if you try to disable SSLv3 at cipher level, you end up disabling TLSv1 too. Hence SSLv3 needs to be disabled at SSL protocol level only which Linode suggests at https://www.linode.com/docs/security/se ... for-poodle i.e. for dovecot Code: ssl_protocols = !SSLv2 !SSLv3 list of TLSv1 ciphers Code: openssl ciphers -v 'TLSv1' | sort |
|
| Page 1 of 1 | All times are UTC-04:00 |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|