POODLE Vulnerability : Help Us Help You!

As part of our remediation plan following the public disclosure of the POODLE vulnerability, we will be disabling support for SSLv3 from our servers. We intend to do this on November 18, 2014.

Testing your environment

While we have performed extensive tests on our systems, we would ask all users of our hosted sites to execute the “ssl3_test.py” test script (available for download at the following location) to confirm that you can access, through your environment, a test site called “poodletest.shotgunstudio.com” running on a server on which SSLv3 has been disabled. The script connects anonymously to the test site and performs basic operations such as version creation, version deletion and (optionally) thumbnail upload.

The script can be invoked as follows:

python ssl3_test.py [ -a pathToShotgunAPI ] [ -t pathToThumbnailImage ]

Note that the –a argument can be omitted if the path to the Shotgun API is already in your PYTHONPATH environment variable. For instance:

python ssl3_test.py –a ~/dev/shotgun_api –t ~/image.jpg

If the script runs successfully, this means that you can successfully access a SSLv3-disabled server and you should be ready to go for the November 18 deadline. Otherwise, please contact support@shotgunsoftware.com so that we can quickly help troubleshoot your issue.

Disabling SSLv3 in your browsers

All modern Web browsers already support other cryptographic protocols, so access to the Web application will not be impacted when we turn off SSLv3 on our servers. You are however encouraged to disable SSLv3 in your browsers: Details on how to do this are available at the following location: https://zmap.io/sslv3/browsers.html

Again, please let us know at support@shotgunsoftware.com if you have any concerns or questions about this.


Thanks,
Shotgun Team


---

Background information on POODLE

A low-to-high1 severity vulnerability affecting web servers and other applications that use Secure Sockets Layer v3 (SSLv3) has been disclosed. An attacker who is in an active man-in-the-middle (MitM) position may be able to launch a chosen plain-text attack to decrypt and obtain targeted portions of SSLv3 encrypted data such as HTTP session cookies.

The vulnerability resides in SSLv3 connections that use block ciphers in cipher-block chaining (CBC) mode. At its core, the issue is the fact that SSLv3 does authentication before encryption. It is a design flaw within the protocol itself, and not of any specific implementation. As such, any application that relies or supports SSLv3 and accepts cipher suites that use CBC with encryption are vulnerable. Transport Layer Security (TLS) is not vulnerable directly. However, it is possible to perform downgrade attacks in which the client is forced to use SSLv3 instead of TLS, if SSLv3 is supported.

The attack that exploits this SSLv3 vulnerability is referred to as Padding Oracle On Downgraded Legacy Encryption (POODLE). The POODLE attack is very similar to the Browser Exploit Against SSL/TLS (BEAST)3 attack from a few years ago. That is, the attacker is not only required to have a privileged network position, but also the ability to influence the client to send multiple requests to the server. Because of this requirement, POODLE attacks will typically target HTTPS connections. It is important to note that the attack is not exclusive to only HTTPS, and that other services that use SSLv3 may be vulnerable to practical attack as well.

Despite its age and available replacements, SSLv3 is still widely used. As of October 12, 2014, 96.9% of the HTTPS Alex Top 1 Million websites supported SSLv34, and are therefore likely affected by POODLE.