SSL 3 is dead, killed by the POODLE attack | Qualys
Summary: Qualys reported on October 14 that the POODLE attack (CVE-2014-3566) exploits a flaw in the CBC encryption scheme as implemented in SSL 3, and is conceptually similar to the 2011 BEAST exploit. Exploiting it requires an attacker to inject malicious JavaScript into the victim's browser and observe and manipulate encrypted traffic on the wire, and Qualys gave servers vulnerable to POODLE a C grade in its SSL Labs tests.
Key Takeaway: An active man-in-the-middle attacker can force browsers to downgrade connections all the way to SSL 3 even on servers supporting the newest TLS, so disabling SSL 3 is required regardless of what else you run - and the remaining holdouts are largely Internet Explorer 6 on Windows XP.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-3566
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026