====== CVE-2014-3566 POODLE - An SSL 3.0 Vulnerability ======
Found by Googlers, Padding Oracle On Downgraded Legacy Encryption (POODLE) Attack on SSLv3.
Related CVE
  * CVE-2014-3513, SRTP Memory Leak
  * CVE-2014-3567, Session Ticket Memory Leak
  * CVE-2014-3568, Build option no-ssl3 is incomplete

===== Further Reading =====
  * [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566]]
  * [[http://blog.gslin.org/archives/2014/10/16/5164/|SSL 3.0 爆炸，CVE-2014-3566，POODLE]]
  * [[http://drops.wooyun.org/papers/3194|CVE-2014-3566 SSLv3 POODLE原理分析]]
  * [[https://www.imperialviolet.org/2014/10/14/poodle.html|POODLE attacks on SSLv3]]
  * [[https://www.openssl.org/~bodo/ssl-poodle.pdf|PDF Posted Detail from Google]]

===== About Networking Vendors =====
  * Only few vendors talk about this issue.

^ Vendor      ^ Vulnerable     ^ Announcement       ^ Announce Date ^
| A10  | Yes |[[https://www.a10networks.com/vadc/index.php/cve-2014-3566-from-beast-to-poodle-or-dancing-with-beast/|A10 vADC Blog]] | 2014-10-15 |
| Arbor Networks | Investigating... | [[https://arbor.custhelp.com/app/answers/detail/a_id/2549|Internal Field(login required)]] | 2014-10-15 |
| Arista Networks | Not responded | [[http://www.arista.com/en/support/security-advisories/|Security Advisory]] | - |
| Aruba Networks | Yes | [[http://www.arubanetworks.com/support/alerts/aid-10142014.txt|Aruba Alert]] | 2014-10-14 |
| Avaya | Not responded | [[https://support.avaya.com/helpcenter/|Avaya Security Advisories]] | - |
| BlueCoat  | Yes | [[https://bto.bluecoat.com/security-advisory/sa83|BlueCoat Security Advisories]] | 2014-10-15 |
| Brocade | Not responded | [[http://www.brocade.com/downloads/documents/technical_support_bulletins/brocade-assessment-bashabug-vulnerability.pdf|Brocade]] | - |
| Cellopoint | Not responded | [[http://www.cellopoint.com/tw/about/news/release|Cellopoint News]] | - |
| CheckPoint | No | [[https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102989|CheckPoint]] | 2014-10-14 |
| Cisco | Investigating... | [[http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141015-poodle|Cisco]] | 2014-10-15 |
| Dlink | Being Confirmed…  | | |
| Enterasys (Part of Extreme) | Not responded | [[|Extreme eSupport]] | - |
| Extreme Networks | Not responded | [[|Extreme eSupport]] | - |
| F5 | Investigating... | [[https://support.f5.com/kb/en-us/solutions/public/15000/700/sol15702.html|F5 Security Advisory]] | 2014-10-14 |
| FireEye | Yes | [[http://www.fireeye.com/resources/pdfs/support-notices/fireeye-statement-about-poodle-ssl-3-0-vulnerability.pdf|FireEye]] | 2014-10-15 |
| Fortinet | Yes | [[http://www.fortiguard.com/advisory/SSL-v3--POODLE--Vulnerability|FortiGuard]] | 2014-10-15 |
| iMPERVA | Yes | [[http://www.imperva.com/Services/adc_advisories_response_poodle_CVE_2014_3566| iMPERVA Security Advisory]] | 2014-10-15 |
| Juniper | Yes | [[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10656&actp=RSS|Juniper KB]]  | 2014-10-15 |
| McAfee | Yes | [[https://kc.mcafee.com/corporate/index?page=content&id=SB10090|McAfee]] | 2014-10-15 |
| NetAxle | Not responded | Response from vendor | -- |
| Palo Alto | Not responded | [[https://securityadvisories.paloaltonetworks.com/|Palo Alto]] | - |
| Radware | Not responded | [[http://security.radware.com/SiteCode/Templates/template_1_1_2%282x1%29_1.aspx?pageid=105&id=620|Emergency Response]] | - |
| Ruckus Wireless | Not responded | [[http://www.ruckuswireless.com/security|Ruckus Security]] | -- |
| Silver Peak | Not responded | Internal Document | - |
| Sophers | Not responded | [[http://www.sophos.com/en-us/support/knowledgebase/|Sophers]] | - |
| Sourcefire (Part of Cisco) | | Check Cisco | - |
| Splunk | Yes | [[http://www.splunk.com/view/SP-CAAANKE| Splunk Answers ]]  | - |
| TippingPoint | Yes | [[https://tmc.tippingpoint.com/TMC/library/announcements/software_release__poodle_.pdf|PDF at TMC]] | 2014-10-24 |
| VMware | Yes/No? | [[http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2092133|VMware KB]] | 2014-10-15 |
| Websense | Yes | [[http://www.websense.com/support/article/kbarticle/SSLv3-POODLE-Vulnerability-CVE-2014-3566|Websense ]] | 2014-10-16 |

===== Best Practices =====
  * To be continued...