THE INFORMATION IN THIS ARTICLE APPLIES TO:
- Mail Express v3.3 and later
DISCUSSION
The "POODLE Vulnerability" (CVE-2014-3566) is a serious vulnerability in the blueprints of SSL v3.0 and thus affects any product following the protocol. This weakness allows stealing the information protected, under normal conditions, by the SSL encryption used to provide communication security and privacy over the Internet for applications such as web, email, instant messaging (IM), and some virtual private networks (VPNs).
Mail Express supports SSL v3 which is vulnerable, however, work is in progress to update the default configuration to mitigate this vulnerability. Customers can manually change their configuration as described below.
WORKAROUND
Turn on use of FIPS 140-2 compliant protocols
- Log in to the Mail Express administration interface.
- In the navigation pane, under Configuration, click General. The General Settings page appears.
- Under Enhanced Communication Security, select the Use only protocols and algorithms approved for use by FIPS 140-2 check box.
- Click Save. A message appears at the top of the page.
- Click Restart server now.
| -OR- | ||
| ||
| ||
sslProtocol="all" | ||
| ||
sslEnabledProtocols="SSLv2Hello,SSLv3,TLSv1" | ||
with: | ||
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" | ||
| ||
sslEnabledProtocols=" TLSv1,TLSv1.1,TLSv1.2" | ||
The end of the string might look something like: | ||
scheme="https" secure="true"sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" | ||
| ||
The resulting cipher list should look like this: | ||
ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA" | ||
| ||