securitysslweblogicweblogic11gpoodle-attack

Is the HTTPS protocol affected by the Poodle SSLv3 attack?

We have an IPlanet webserver which communicates to WebLogic(app server) on non-SSL (HTTP) port. we are not using HTTPS in WebLogic and the webservers and app servers are behind a firewall. A certificate is installed on weblog server instances but we don't use the HTTPS port. The IPlanet web server is running on HTTPS ports and behind a load balancer.

LB to (HTTPSWebServer to (HTTP) Weblogic is the traffic flow. No traffic directly comes to web server or Weblogic.

For POODLE remediation, do we still need to disable SSLv3 for web server and app server?

Solution

  • Looks like you are terminating SSL (or HTTPS) traffic at WebServer. There are two parts:

    1. LB to WebServer (HTTPS Traffic): Disable SSLv3 on WebServer. HTTPS means HTTP tunneled over SSL protocol. This is impacted.
    2. WebServer to Weblogic (HTTP Traffic) : You are good here.