PureEngage On-Premises

 View Only

Sign Up

Back to discussions
Expand all | Collapse all

Are any of the Genesys products susceptible to the SSLv3 protocol CVE-2014-3566 (POODLE) issue?

  • 1.  Are any of the Genesys products susceptible to the SSLv3 protocol CVE-2014-3566 (POODLE) issue?

    Posted 10-17-2014 20:41
    There is a security vulnerability issue with the SSLv3 protocol. This vulnerability is commonly known as POODLE and has been assigned CVE-2014-3566.

    The Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability allows a man-in-the-middle attacker to decrypt ciphertext.

    Is SSLv3 used by any Genesys product?


  • 2.  RE: Are any of the Genesys products susceptible to the SSLv3 protocol CVE-2014-3566 (POODLE) issue?

    Posted 10-20-2014 05:12
    Response from Genesys support:
    The following considerations would be useful for addressing SSLv3 vulnerability:
     
    If you run Genesys applications on UNIX:
    You would need to install Security Pack on UNIX Release Num. 8.5.000.03
    =======================
    Support for selecting initial protocol when establishing secure connection. An application can now specify the lowest compatible protocol used by Security Pack on UNIX to send and accept secure connection requests on one or more of its connections, thereby limiting the use of obsolete protocols. Use the following new option:
     
    sec-protocol
    Default Value: SSLv23
    Valid Values: SSLv23, SSLv3, TLSv1, TLSv11
    Changes Take Effect: Immediately
     
    Specifies the protocol used by the component to set up secure connections.
    =======================
     
    After this, you would need to verify that applications are able to communicate in TLSv1 protocol.
     
    For Windows
    The default protocol chosen would be in the following preferred order TLS 1.0 -> SSL 3.0 -> SSL 2.0 (Other supported protocol depends on the Windows version)
     
    If you wish to disable SSL 2.0 and SSL 3.0, they should disable it via registry, by setting the corresponding protocol's "Enabled" value to "0" under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\. For further details please refer to the article:
    http://support.microsoft.com/kb/245030