Loading HuntDB...

POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)

X
X (Formerly Twitter)
Submitted None
Reported by omespino

Vulnerability Details

Technical details and impact analysis

Cryptographic Issues - Generic
**Summary:** POODLE SSLv3 bug on multiple twitter smtp servers **Description:** CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. ## Steps To Reproduce: Hi Twitter Sec team here is the POC 1. get a nmap installation and twitter_smtp_ssl_servers.txt file (attached) 2. run this command : "nmap -sV --version-light -Pn --script ssl-poodle -p 25 -iL twitter_smtp_ssl_servers.txt | grep -B 5 VULNERABLE" 3. See the results ## Supporting Material/References: * An output screentshot and the twitter_smtp_ssl_servers.txt are attached.

Related CVEs

Associated Common Vulnerabilities and Exposures

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cryptographic Issues - Generic