POODLE

cryptographysecurity

A 2014 attack that forces a downgrade to SSL 3.0 to exploit its broken CBC padding.

Padding Oracle On Downgraded Legacy Encryption abused the fact that a client would fall back to SSL 3.0, whose padding could be probed byte by byte to recover data. It effectively ended SSL 3.0 in the field.

POODLE exploited SSL 3.0's padding, which was not covered by the message authentication code, allowing an attacker to modify padding bytes and learn plaintext one byte at a time by observing whether the connection failed. The protocol was long obsolete when the attack was published.

The reason it mattered anyway is downgrade. Clients and servers negotiated the best mutually supported version, and many implementations would retry with older versions if a handshake failed, which meant an attacker who could interfere with connections could force both sides down to SSL 3.0 even though both supported something modern. The vulnerability was in a protocol nobody wanted to use and everyone still accepted.

The fixes are the durable part. Downgrade protection mechanisms make a forced fallback detectable, and the broader lesson was that supporting an obsolete protocol for compatibility is supporting it for attackers, since they choose which version is negotiated. That reasoning is why deprecation eventually became removal rather than discouragement, and why modern guidance is to disable old versions outright rather than to prefer new ones.

Also known as: POODLE, Padding Oracle On Downgraded Legacy Encryption, CVE-2014-3566

← All glossary entries