dovecot - Oct 2014 - Dovecote 1.2.17 poodle

Hi, how do I protect dovecot 1.2.17 against poodle?

Br
/Marc
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20141019/b4152487/attachment-0001.sig>

Am 19.10.2014 um 17:25 schrieb Marc Rantanen:
> Hi, how do I protect dovecot 1.2.17 against poodle?
a) Dovecot is hardly affected by Poodle, read how it works
b) Dovecot 1.2 is unsupported
c) running unsupported SW has much more problems than Poodle

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20141025/48868da1/attachment.sig>

On October 19, 2014 5:25:01 PM Marc Rantanen <marc at eciceron.se> wrote:
> Hi, how do I protect dovecot 1.2.17 against poodle?
http://en.m.wikipedia.org/wiki/Poodle

If its not that then sorry, tell more to get more help

Marc Rantanen:
> Hi, how do I protect dovecot 1.2.17 against poodle?
<anything without warranty, totally untested ...>

I just looked into the sourcecode. looks like there was an option  
"ssl_protocols" in dovecot.conf.
( check: dovecot -a | grep ssl_protocols )

then you should be able to set "ssl_protocols = !SSLv2 !SSLv3"
restart and check:
   openssl s_client -connect $dovecot_host:imaps -tls1 should work while
   openssl s_client -connect $dovecot_host:imaps -ssl3 should not
(or use pop3s)

Also if you could recompile from source then you may test the following patch.
At a first glance it should only avoid dovecot connect to a next  
dovecot via SSLv3

Index: src/lib-ssl-iostream/iostream-openssl-context.c
==================================================================---
src.orig/lib-ssl-iostream/iostream-openssl-context.c
2014-10-25 22:59:28.000000000 +0200
+++ src/lib-ssl-iostream/iostream-openssl-context.c     2014-10-25  
23:00:12.000000000 +0200
@@ -358,7 +358,7 @@

         /* enable all SSL workarounds, except empty fragments as it
            makes SSL more vulnerable against attacks */
-       SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2 |
+       SSL_CTX_set_options(ctx->ssl_ctx, (SSL_OP_NO_SSLv2 |  
SSL_OP_NO_SSLv3) |
                             (SSL_OP_ALL &  
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS));
         if (SSL_CTX_need_tmp_RSA(ctx->ssl_ctx))
                 SSL_CTX_set_tmp_rsa_callback(ctx->ssl_ctx, ssl_gen_rsa_key);
Index: src/login-common/ssl-proxy-openssl.c
==================================================================---
src.orig/login-common/ssl-proxy-openssl.c   2014-10-25
23:00:36.000000000 +0200
+++ src/login-common/ssl-proxy-openssl.c        2014-10-25  
23:02:19.000000000 +0200
@@ -973,8 +973,8 @@

         /* enable all SSL workarounds, except empty fragments as it
            makes SSL more vulnerable against attacks */
-       SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL &
-                           ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
+        SSL_CTX_set_options(ctx->ssl_ctx, (SSL_OP_NO_SSLv2 |  
SSL_OP_NO_SSLv3) |
+                            (SSL_OP_ALL &  
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS));

  #ifdef SSL_MODE_RELEASE_BUFFERS
         SSL_CTX_set_mode(ssl_ctx, SSL_MODE_RELEASE_BUFFERS);