Getting Data In

Found a SSLv3 "POODLE" vulnerability on Universal Forwarder 6.4.2. How to resolve this?

season88481
Contributor

We just found SSLv3 "POODLE" vulnerability alerts from our IPS system. And our Splunk Universal Forwarder is in 6.4.2.

I thought the SSLv3 POODLE issue only appear at Splunk version earlier than 6.3?

Should I use the same workaround mention here?
https://answers.splunk.com/answers/176970/is-it-possible-to-disable-ssl-v3-on-the-universal.html

Many thanks in advance.

0 Karma
1 Solution

gokadroid
Motivator

Can you please have a look at this blog which talks about fixing the poodle vulnerability on Splunk:

http://blogs.splunk.com/2014/10/22/mitigating-the-poodle-attack-in-splunk/

View solution in original post

aaraneta_splunk
Splunk Employee
Splunk Employee

@season88481 - Did the Splunk blog post referenced by gokadroid below help answer to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

gokadroid
Motivator

Can you please have a look at this blog which talks about fixing the poodle vulnerability on Splunk:

http://blogs.splunk.com/2014/10/22/mitigating-the-poodle-attack-in-splunk/

View solution in original post

season88481
Contributor

So we are not using SSL forwarding between uf and HWF.

The only SSL communication I can think of is the REST connection of 8089. However, since we are not doing any command line or REST request to the uf. So I will try disabling the management port by deploying a server.conf

[httpServer]
disableDefaultPort = true

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!