An organization uses an internal, web-based chat service that is served by an Apache HTTP daemon. A vulnerability scanner has identified this service is susceptible to a POODLE attack. Which of the…

The correct answer is A. AccessFileName /var/http/.acl. NOTE: The answer key lists A (AccessFileName), but this is technically incorrect. POODLE (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability in the SSLv3 protocol itself. The configuration line 'SSLProtocol -all +SSLv3' disables all SSL/TLS protocols and then…

Technical Integration of Enterprise Security

Question

An organization uses an internal, web-based chat service that is served by an Apache HTTP daemon. A vulnerability scanner has identified this service is susceptible to a POODLE attack. Which of the following strings within the server’s virtual-host configuration block is at fault and needs to be changed?

Options

AAccessFileName /var/http/.acl
BSSLProtocol -all +SSLv3
CAllowEncodeSlashes on
DSSLCertificateFile /var/certs/home.pem
EAllowOverride Nonfatal=All AuthConfig

How the community answered

(32 responses)

A
47% (15)
B
6% (2)
C
31% (10)
D
3% (1)
E
13% (4)

Explanation

NOTE: The answer key lists A (AccessFileName), but this is technically incorrect. POODLE (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability in the SSLv3 protocol itself. The configuration line 'SSLProtocol -all +SSLv3' disables all SSL/TLS protocols and then re-enables only SSLv3, making the server exclusively vulnerable to POODLE attacks. This is the line that must be changed - it should instead disable SSLv3 (e.g., 'SSLProtocol all -SSLv3 -SSLv2'). AccessFileName (A) configures per-directory access control file lookups and has no relationship whatsoever to SSL protocol selection or POODLE. The technically correct answer is B.

Topics

#SSL/TLS#POODLE attack#Apache configuration#protocol vulnerability

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice