The vulnerability relates to version 3 of an encryption technology known as SSL (Secure Socket Layer) that dates back to 1996. SSLv3 is still supported by most of the browsers and webservers on the Internet but has been replaced as the default encryption selection by newer encryption technology known as TLS (Transport Layer Security). Encryption is used to secure our connection on the Internet when we do, for example, online banking or purchase online.
When a browser connects to a webserver that supports this older technology there is a risk that if SSLv3 is the primary encryption or the connection security falls back from the newer TLS technology to SSLv3 then an attacker could potentially exploit this vulnerability. While it is unusual for websites to still be using SSLv3 as the default encryption technology, it is possible for an attacker to cause connection failures that force the server to default back to the older, insecure, technology. By exploiting this vulnerability, an attacker could gain access to things like passwords and cookies, enabling him to access a user’s private account data on a website.
Companies have kept this old technology on their servers to ensure backward compatibility if needed. The two main options for companies to fix this vulnerability are to disable SSLv3 entirely, or change the security downgrade feature so that only the newer TLS encryption is used so that users remain safe.
As we have seen with these previous vulnerabilities it takes companies time to upgrade or in this case disable the software that is causing the issue (SSLv3 support) on the server and browser sides.  72 hours after the disclosure of the vulnerability, AVG researchers reveal that 37% of the top 100,000 domains are still vulnerable.
Staying safe:
Although web users can’t take any direct action to stay safe from POODLE, it is always good practice to keep all their systems and software updated.
For Windows users, run Windows Update to ensure you have installed all of the latest security patches. For Apple Mac users, ensure you run the Mac App Store and update to the latest security patches for your system.
By keeping your browser, operating system and security software up-to-date, you will ensure you have the best chance of avoiding malware and web based vulnerabilities.
