Re: Dovecote 1.2.17 poodle

[A. Schulze]

Marc Rantanen:
Hi, how do I protect dovecot 1.2.17 against poodle?

<anything without warranty, totally untested ...>

I just looked into the sourcecode. looks like there was an option  
"ssl_protocols" in dovecot.conf.
( check: dovecot -a | grep ssl_protocols )

then you should be able to set "ssl_protocols = !SSLv2 !SSLv3"
restart and check:
  openssl s_client -connect $dovecot_host:imaps -tls1 should work while
  openssl s_client -connect $dovecot_host:imaps -ssl3 should not
(or use pop3s)

Also if you could recompile from source then you may test the following patch.
At a first glance it should only avoid dovecot connect to a next  
dovecot via SSLv3

Index: src/lib-ssl-iostream/iostream-openssl-context.c
===================================================================
--- src.orig/lib-ssl-iostream/iostream-openssl-context.c         
2014-10-25 22:59:28.000000000 +0200
+++ src/lib-ssl-iostream/iostream-openssl-context.c     2014-10-25  
23:00:12.000000000 +0200
@@ -358,7 +358,7 @@

        /* enable all SSL workarounds, except empty fragments as it
           makes SSL more vulnerable against attacks */
-       SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2 |
+       SSL_CTX_set_options(ctx->ssl_ctx, (SSL_OP_NO_SSLv2 |  
SSL_OP_NO_SSLv3) |
                            (SSL_OP_ALL &  
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS));
        if (SSL_CTX_need_tmp_RSA(ctx->ssl_ctx))
                SSL_CTX_set_tmp_rsa_callback(ctx->ssl_ctx, ssl_gen_rsa_key);
Index: src/login-common/ssl-proxy-openssl.c
===================================================================
--- src.orig/login-common/ssl-proxy-openssl.c   2014-10-25  
23:00:36.000000000 +0200
+++ src/login-common/ssl-proxy-openssl.c        2014-10-25  
23:02:19.000000000 +0200
@@ -973,8 +973,8 @@

        /* enable all SSL workarounds, except empty fragments as it
           makes SSL more vulnerable against attacks */
-       SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL &
-                           ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
+        SSL_CTX_set_options(ctx->ssl_ctx, (SSL_OP_NO_SSLv2 |  
SSL_OP_NO_SSLv3) |
+                            (SSL_OP_ALL &  
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS));

 #ifdef SSL_MODE_RELEASE_BUFFERS
        SSL_CTX_set_mode(ssl_ctx, SSL_MODE_RELEASE_BUFFERS);