A vulnerability referred to as "POODLE" (Padding Oracle On Downgraded Legacy Encryption) was recently announced by CERT. The POO8DLE vulnerability is a man-in-the-middle-attack, which means that a 3rd party with access to network traffic could make use of this exploit to decrypt traffic between a client and server. This vulnerability only impacts traffic that is being encrypted by SSL v3, which is a legacy protocol that has been included in modern web browsers for backwards compatibility. By default, moderns browser prefer to make use of TLS (Transport Layer Security) for encrypting connections instead of SSL v3, but because SSL v3 is listed as an available protocol by default, there remains a risk that a browser could decide to downgrade to SSL v3 and thereby expose the connection to this vulnerability.
The only way to mitigate this vulnerability is to prevent the use of SSL v3. This can be done by disabling it on the web server, or by disabling it within the web browser itself. To ensure that this vulnerability isn't an issue for InfraWare users, our engineers will disable SSL v3 on our web servers starting on 11/8/2014 11:59 EST. Browsers (Internet Explorer 7+, Chrome, Firefox) utilizing their default encryption settings should see no impact when this change is implemented, as connections will automatically utilize the preferred TLS protocol. Internet Explorer 6 did not have TLS enabled by default, so Internet Explorer 6 users will need to ensure that TLS is enabled under Tools -> Internet Options -> Security.
Ahead of the November 8th change, InfraWare engineers have already disabled SSL v3 for the IMC Beta and EHR Web Portal Beta. Users are encouraged to open either page and verify that the login page is displayed without issue. If so, your browser is not depending on SSL v3. If you have trouble, that is an indication that you would have trouble on the production sites after the 11/8 change.
Please open a ticket with Support if you should have any questions or concerns regarding the vulnerability or planned changes.
