POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)
X
X (Formerly Twitter)
Submitted None
Actions:
Reported by
omespino
Vulnerability Details
Technical details and impact analysis
**Summary:** POODLE SSLv3 bug on multiple twitter smtp servers
**Description:** CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
## Steps To Reproduce:
Hi Twitter Sec team here is the POC
1. get a nmap installation and twitter_smtp_ssl_servers.txt file (attached)
2. run this command :
"nmap -sV --version-light -Pn --script ssl-poodle -p 25 -iL twitter_smtp_ssl_servers.txt | grep -B 5 VULNERABLE"
3. See the results
## Supporting Material/References:
* An output screentshot and the twitter_smtp_ssl_servers.txt are attached.
Related CVEs
Associated Common Vulnerabilities and Exposures
CVE-2014-3566
UNKNOWN
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cryptographic Issues - Generic