AIX 7.1 TL 3 : nettcp (IV73316) (POODLE)

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote AIX host is missing a security patch.

Description :

A man-in-the-middle (MitM) information disclosure vulnerability,
known as POODLE, exists due to the way SSL 3.0 handles padding bytes
when decrypting messages encrypted using block ciphers in cipher block
chaining (CBC) mode. A MitM attacker can decrypt a selected byte of a
cipher text in as few as 256 tries if they are able to force a victim
application to repeatedly send the same data over newly created SSL
3.0 connections.

See also :

http://aix.software.ibm.com/aix/efixes/security/nettcp_advisory.asc
https://www.imperialviolet.org/2014/10/14/poodle.html
https://www.openssl.org/~bodo/ssl-poodle.pdf
https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00

Solution :

Install the appropriate interim fix.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS Temporal Score : 3.1
(CVSS2#E:U/RL:TF/RC:UR)
Public Exploit Available : false

Family: AIX Local Security Checks

Nessus Plugin ID: 84265 ()

Bugtraq ID: 70574

CVE ID: CVE-2014-3566

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now