This POODLE Bites: Exploiting The SSL 3.0 Fallback

Posted by Bruno Luiz on Jun 10

Introduction

SSL 3.0 [RFC6101] is an obsolete and insecure protocol. While for most practical
purposes it has been replaced by its successors TLS 1.0 [RFC2246], TLS 1.1 [RFC4346],
and TLS 1.2 [RFC5246], many TLS implementations remain backwards­compatible with
SSL 3.0 to interoperate with legacy systems in the interest of a smooth user experience.
The protocol handshake provides for authenticated version negotiation, so normally the
latest…

Leave a Reply