Getting Data In

Found a SSLv3 "POODLE" vulnerability on Universal Forwarder 6.4.2. How to resolve this?

season88481
Contributor

We just found SSLv3 "POODLE" vulnerability alerts from our IPS system. And our Splunk Universal Forwarder is in 6.4.2.

I thought the SSLv3 POODLE issue only appear at Splunk version earlier than 6.3?

Should I use the same workaround mention here?
https://answers.splunk.com/answers/176970/is-it-possible-to-disable-ssl-v3-on-the-universal.html

Many thanks in advance.

0 Karma
1 Solution

gokadroid
Motivator

Can you please have a look at this blog which talks about fixing the poodle vulnerability on Splunk:

http://blogs.splunk.com/2014/10/22/mitigating-the-poodle-attack-in-splunk/

View solution in original post

aaraneta_splunk
Splunk Employee
Splunk Employee

@season88481 - Did the Splunk blog post referenced by gokadroid below help answer to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

gokadroid
Motivator

Can you please have a look at this blog which talks about fixing the poodle vulnerability on Splunk:

http://blogs.splunk.com/2014/10/22/mitigating-the-poodle-attack-in-splunk/

season88481
Contributor

So we are not using SSL forwarding between uf and HWF.

The only SSL communication I can think of is the REST connection of 8089. However, since we are not doing any command line or REST request to the uf. So I will try disabling the management port by deploying a server.conf

[httpServer]
disableDefaultPort = true

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...