POODLE SSLv3 Vulnerability

The POODLE SSLv3 vulnerability [CVE-2014-3566] requires that an attacker already have the vantage point on a network to perform a man-in-the-middle (MITM) attack against a user.  For example, a public WiFi hotspot in a coffee shop or airport would give an attacker a MITM vantage point.

An attacker can then force a client's web browser to downgrade the encryption connection to SSLv3 or lower to exploit the vulnerability in these older versions of SSL.

An attacker will most likely use this vulnerability to steal session cookies to read a victim's email or access other Internet accounts.

Mitigations for system administrators

System administrators should configure their servers to not use SSLv3 or earlier.  Servers accessible from the Internet can be checked using Qualys' SSL Server Test.
https://www.ssllabs.com/ssltest/

Servers that still require SSLv3 to operate with legacy systems should implement the TLS_FALLBACK_SCSV feature to prevent unnecessary protocol downgrades from happening.
https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00

Mitigations for end-users

End-users should keep their web browsers up to date.  Patches will be available to disable SSLv3 or earlier soon.  End-users that don't want to wait for patches can configure their web browsers to disable SSLv3 and earlier as follows.

Chrome
Start the browser using the command-line flag:  --ssl-version-min=tls1

Firefox
Install the SSL Version Control extension:
https://addons.mozilla.org/en-US/firefox/addon/ssl-version-control/

or

Under about:config set security.tls.version.min to 1

Internet Explorer
Internet Explorer 6 does not support TLS.  Users of Internet Explorer 6 should update to the latest version possible on their operating system.

To change the default protocol version to be used for HTTPS requests, perform the following steps:

1. On the Internet Explorer Tools menu, click Internet Options.
2. In the Internet Options dialog box, click the Advanced tab.
3. In the Security category, uncheck Use SSL 3.0 and check Use TLS 1.0, Use TLS 1.1, and Use TLS 1.2 (if available).
4. Click OK.
5. Exit and restart Internet Explorer.

Safari
Unknown.

References

https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
http://blog.erratasec.com/2014/10/some-poodle-notes.html
https://www.imperialviolet.org/2014/10/14/poodle.html
http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
https://www.ssllabs.com/ssltest/
https://technet.microsoft.com/en-us/library/security/3009008.aspx
https://www.openssl.org/~bodo/ssl-poodle.pdf
https://access.redhat.com/articles/1232123