[yocto] FW: [oss-security] Truly scary SSL 3.0 vuln to be revealed soon:

[Sona Sarmadi]

Hi all,

It seems that another vulnerability is coming soon, the advice is disable SSLv3.:
http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/


>From Hanno Böck [hanno at hboeck.de]:
============================================
Whether it's scary or not I have an advice for you: Disable SSLv3.

It causes a lot of headache already. I once had to debug a rather subtle issue in combination with SNI.
The problem: Browsers downgrade out of protocol to SSLv3 if they can't connect via TLS. They do this in order to support broken server implementations. However this downgrade can also be triggered by bad or slow internet connections - and then you'll loose SNI. So sometimes your visitors will get the wrong certificate presented.
I solved this for my servers by disabling SSLv3. It was a minor problem when I did this but it is almost no problem today.

You will lock out IE6 users on Windows XP. However even people who use Windows XP+IE and installed their updates have TLS 1.0 support.
I also encountered a small number of people who had manually disabled TLS 1.0 in firefox for unknown reasons. However this was a few years ago. Current Firefox versions make it harder to do this. I assume the reason was that they thought "v3 sound newer than v1.0".

A number of people already recommend disabling SSLv3, e.g. the Qualys configuration guide. Disable it now - no matter if the rumors about a serious vuln are true, you'll be safe.

BR - Sona 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: signature.asc
URL: <http://lists.yoctoproject.org/pipermail/yocto/attachments/20141014/c913a9ca/attachment.pgp>