POODLE Vulnerability on SSLv3 fix causing the Vugen script's replay to fail

  • KM01211533
  • 15-Oct-2014
  • 15-Oct-2014

Summary

In order to fix the POODLE vulnerability it is necessary to use TLS instead. This causes the SSL handshake to fail the scripts

Question

Further information about POODLE can be found in the following link:

http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

Answer

Since the change in order to overcome this vulnerability is to use TLS instead of SSLv3, it is necessary to update the Vugen scripts to do so or a SSL handshake error will come up during replay.

The function web_set_sockets_option() should be added right before the first request against the application server like this code snippet:

Action()

{

      web_set_sockets_option("SSL_VERSION","TLS");

      [...]