CVE-2014-3566 Poodle: is OpenVPN affected

sejtam

if so, how to protect the server or clients?
Is there a way to disable fallback to SSLv3?

Traffic

Information provided by #OpenVPN on freenode IRC channel:

"poodle" is (#1) http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html . OpenVPN uses TLSv1.0, or (with >=2.3.3) optionally TLSv1.2 and is thus not impacted by POODLE. See also: !hardening for some unrelated TLS security options OpenVPN has or (#2) https://www.tinfoilsecurity.com/poodle for a tool for testing your websites.

chr[]

trick question: how to disable SSLv3?

--tls-cipher ALL:!SSLv3

I get:

TLS_ERROR: BIO read tls_read_plaintext error: error:140830B5:SSL routines:SSL3_CLIENT_HELLO:no ciphers available

openvpn version 2.2.1-8+deb7u2 debian wheezy

tmack0

This post has been referenced in several places as evidence that the OpenVPN server is safe from Poodle. This should be qualified with "as long as you use the current version". Older versions still readily accept connections using SSLv3. Checking the changelog on the available downloads, SSLv3 was disabled in v2.0.11, and was available but selectable in v2.0.10. We verified this in one of our existing installs (running 2.0.8), openssl s_client -connect vpn.server.fqdn:943 -ssl3

CONNECTED(00000003)
...
verify error:num=19:self signed certificate in certificate chain
verify return:0
SSL handshake has read 4951 bytes and written 434 bytes
---
...
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : SSLv3 <<-------------------------------
Cipher : AES256-SHA

Traffic

tmack0 wroteChecking the changelog on the available downloads, SSLv3 was disabled in v2.0.11, and was available but selectable in v2.0.10. We verified this in one of our existing installs (running 2.0.8), openssl s_client -connect vpn.server.fqdn:943 -ssl3

The preceding post is a reference to OpenVPN-Access-Server not OpenVPN-Community-Edition.

It belongs in a post such as:
https://forums.openvpn.net/topic17313.html

OpenVPN Technologies could have done a better job by having an official thread for the Poodle threat on OpenVPN Technologies Access Server .. but there is none.

For More detailed Poodle Information go here:
http://disablessl3.com/#openvpn