A Poodle attack is a form of man-in-the-middle attack that can occur when using HTTPS protocol to communicate from a web client to a server.
http://en.wikipedia.org/wiki/POODLE
http://www.symantec.com/connect/blogs/ssl-30-vulnerability-poodle-bug-aka-poodlebleed
The web portal supplied with PD is based on the Apache Tomcat server. By default, the portal listens for HTTP traffic on port 3030 and HTTPS traffic on port 3443.
The following steps help detail how to disable SSL 3.0 in the supplied Tomcat server.
Locate the ‘Program Files\Sybase\PowerDesigner Portal 16.0\tomcat\conf\server.xml’ file.
Change the following section:
<Connector protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true" port="3443"
keystoreFile="C:\Program Files\Sybase\PowerDesigner Portal 16\keystore\server.keystore"
keystorePass="changeit" maxThreads="150" scheme="https" secure="true" ClientAuth="false"
sslProtocol="TLS" />
To
<Connector protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true" port="3443"
keystoreFile="C:\Program Files\Sybase\PowerDesigner Portal 16\keystore\server.keystore"
keystorePass="changeit" maxThreads="150" scheme="https" secure="true" clientAuth="false"
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" />
and restart the portal.
To protect browsers from using SSL 3.0 in the first place:
For IE, use the Tools->Internet Options menu and locate the ‘Security’ section in the Settings list. Disable the use of SSL 2.0 and 3.0 (and enable TLS versions 1.0, 1.1, and 1.2).
Firefox can be restricted from using SSL 3.0 by typing ‘about:config’ in the address box and searching for ‘tls’. Set the ‘security.tls.version.min’ value to ‘1’.
Other browsers will have similar options for disabling SSL 3.0 and in future (e.g. the next Firefox major release) will permanently disable SSL 3.0 as a default).
Disabling SSL 3.0 at the browser level will help protect users when communicating to other websites using HTTPS protocol. This is not a PD portal-specific fix and should be immediately adopted within your organization.
The settings for the PD supplied Apache Tomcat Server will protect un-altered clients from Poodle attack only when communicating with the PD Web Portal running on that server. Installing the portal components on any other web server may require that server to have SSL 3.0 disabled as necessary.
A test tool is also available at the following link to show the SSL protocols in use by the web server:
http://www.bolet.org/TestSSLServer/
Chris