poodle - Padding Oracle On Downgraded Legacy Encryption SSL vulnerability - Page 3

eschwartz · 11-09-2014, 05:43 PM

Quote:

Originally Posted by Lynx-lynx

I don't know about anyone else but I downloaded the latest Firefox upgrade recently, 33.0.3, and checked against the poodle tests just for the sake of it.

I'm still poodle clear.

Well, they wouldn't have disabled the preference.

Lynx-lynx · 11-09-2014, 06:23 PM

@eschwartz, agreed .... but murphy sometimes makes himself known

bookmarked · 12-02-2014, 06:32 AM

Firefox 34.0.5 has been released. This release changes the default value for security.tls.version.min from 0 to 1, which disables SSLv3 (the source of the poodle vulnerability).

If you've already changed this value to 1, you don't have to do anything - after upgrading, FF will still remember that you set the value to 1. If you want to change this setting from the manual setting (Status = user set ) of 1 to the new default value (Status = default) of 1 (still) after upgrading, you can right-click the setting in about:config and choose Reset.

Personally, I reset it to the new default value.

Code:

Preference Name           Status   Type    Value
security.tls.version.min  default  integer  1

This way I won't have to worry that Mozilla will one day need to change the default value to something else. AFIAK, changes to the default setting won't override a user modified value. Either way, if you have security.tls.version.min = 1, you're protected.

eschwartz · 12-02-2014, 12:01 PM

Plus you can shrink your config files by about 30 Bytes.

12-02-2014, 06:32 AM	#33
bookmarked Addict Posts: 373 Karma: 6346855 Join Date: Nov 2012 Location: US Device: Kindle 4 NT, Paperwhite	Firefox 34.0.5 has been released. This release changes the default value for security.tls.version.min from 0 to 1, which disables SSLv3 (the source of the poodle vulnerability). If you've already changed this value to 1, you don't have to do anything - after upgrading, FF will still remember that you set the value to 1. If you want to change this setting from the manual setting (Status = user set ) of 1 to the new default value (Status = default) of 1 (still) after upgrading, you can right-click the setting in about:config and choose Reset. Personally, I reset it to the new default value. Code: Preference Name Status Type Value security.tls.version.min default integer 1 This way I won't have to worry that Mozilla will one day need to change the default value to something else. AFIAK, changes to the default setting won't override a user modified value. Either way, if you have security.tls.version.min = 1, you're protected.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Short Fiction Anstey, F: The black poodle, and other tales. V1. 23 Sep 2012	crutledge	Kindle Books	0	09-23-2012 11:30 AM
Short Fiction Anstey, F: The black poodle, and other tales. V1. 23 Sep 2012	crutledge	ePub Books	0	09-23-2012 11:29 AM
Short Fiction Anstey, F: The black poodle, and other tales. V1. 23 Sep 2012	crutledge	BBeB/LRF Books	0	09-23-2012 11:28 AM
Free (Kindle UK) Alexandra's Legacy: Legacy, Book 1 by N. J. Walters	arcadata	Deals and Resources (No Self-Promotion or Affiliate Links)	3	09-01-2011 12:33 PM
my story has been frozen ever since i downgraded it	haianh0402	iRiver Story	11	08-09-2010 03:25 AM

11-09-2014, 06:23 PM	#32
Lynx-lynx Treachery of images ... Posts: 4,122 Karma: 93720365 Join Date: May 2012 Location: Australia Device: Sony 650, Kobo Glo, H2O, Aura One, Forma, Libra 2, Libra Colour	@eschwartz, agreed .... but murphy sometimes makes himself known

12-02-2014, 12:01 PM	#34
eschwartz Ex-Helpdesk Junkie Posts: 19,421 Karma: 85400180 Join Date: Nov 2012 Location: The Beaten Path, USA, Roundworld, This Side of Infinity Device: Kindle Touch fw5.3.7 (Wifi only)	Plus you can shrink your config files by about 30 Bytes.

Advert