SSL 3.0 vulnerability discovered

[Corrine]

A security vulnerability in SSL 3.0 has been uncovered by Bodo Möller and two other Google employees that attackers can exploit to calculate the plaintext of secure connections.

SSL 3.0 is an old protocol and most Internet servers use the newer TLS 1.0, TLS 1.1 or TLS 1.2 protocols instead. Client and server usually agree to use the latest protocol version during connections during protocol handshake but since TLS is backwards compatible with SSL 3.0, it can happen that SSL 3.0 is being used instead.

During the first handshake attempt the highest supported protocol version is offered but if this handshake fails, earlier protocol versions are offered instead.
An attacker controlling the network between the client and server could interfere with the handshake attempt so that SSL 3.0 is used instead of TLS.

Instructions are available at the source on how to protect your web browser. See SSL 3.0 vulnerability discovered. Find out how to protect yourself. Note, however, that the link to test the Protocols includes the caveat, "This test reliably detects only the highest supported protocol." Thus, it reliably detects TLS 1.2, but will not reliably detect if SSL3 is disabled. https://www.ssllabs.com/ssltest/viewMyClient.html

 

[Corrine]

https://www.ssllabs.com/ssltest/viewMyClient.html has been updated and now correctly shows "No" for SSL 3.

 

[x BlueRobot]

I've changed my security settings in Pale Moon.

 

[Tekno Venus]

I used this plugin: https://addons.mozilla.org/en-US/firefox/addon/ssl-version-control/. Seems to work fine with PaleMoon 25 and it passed the test in Corrine's second post after installing.

 

[x BlueRobot]

You can simply change the settings within about:config, and then search for the setting called "security.tls.version.min".

• 0 = SSL 3.0
• 1 = TLS 1.0
• 2 = TLS 1.1
• 3 = TLS 1.2

Further Reading - Security.tls.version.* - MozillaZine Knowledge Base