POODLE (Padding Oracle On Downgraded Legacy Encryption)

POODLE was disclosed in October 2014 by Google researchers Bodo Möller, Thai Duong and Krzysztof Kotowicz. SSL 3.0 does not specify the contents of CBC padding bytes and its MAC does not cover them, so an attacker who can make the victim's browser send many requests and can modify the ciphertext learns one byte of a secret, such as a session cookie, for roughly every 256 attempts. The "downgraded" in the name refers to how attackers reached SSL 3.0: browsers that failed a TLS handshake retried with older versions, so a man-in-the-middle could force that fallback.

Why it matters

POODLE left no safe way to use SSL 3.0: its CBC ciphers were broken, and its only other option, RC4, was already known to be weak. The result was the removal of SSL 3.0 from browsers and servers and its formal deprecation in RFC 7568 in 2015. It also drove adoption of TLS_FALLBACK_SCSV (RFC 7507) against fallback-based downgrade attacks. A later variant affected some TLS implementations that did not check CBC padding correctly, which is why scanners also test for "POODLE over TLS".

Example

Confirm that a server no longer offers SSL 3.0:

nmap --script ssl-enum-ciphers -p 443 example.com | grep -E 'SSLv3|TLSv1'

SSLv3 should not appear in the output.

Common misconceptions

• POODLE is fixed by patching OpenSSL. The SSL 3.0 flaw is in the protocol itself; the fix is to disable SSL 3.0 entirely.
• Clients that prefer TLS 1.2 were safe even if the server kept SSL 3.0. Fallback attacks targeted exactly such clients.
• POODLE is still a live risk on modern stacks. Current browsers and TLS libraries ship without SSL 3.0. The remaining risk is old embedded devices and legacy clients, which should be isolated or replaced.