Ubuntu - SSL - Check for Poodle bug

The POODLE bug is a new bug discovered by Google in the SSLv3 protocol. The fix is easy, disable support for SSLv3.

See the google security blog for more info on the bug: http://googleonlinesecurity.blogspot.nl/2014/10/this-poodle-bites-exploiting-ssl-30.html.

Use the following command to check an IP or hostname:

echo | timeout 3 openssl s_client -connect HOSTNAMEORIPADDRESS:443 >/dev/null 2>&1; 
  if [[ $? != 0 ]]; then
    echo "UNKNOWN: HOSTNAMEORIPADDRESS timeout or connection error"; 
  else 
    echo | openssl s_client -connect HOSTNAMEORIPADDRESS:443 -ssl3 2>&1 | grep -qo "sslv3 alert handshake failure\|SSL3_GET_RECORD:wrong version number" && echo "OK: HOSTNAMEORIPADDRESS Not vulnerable" || echo "FAIL:  HOSTNAMEORIPADDRESS vulnerable; sslv3 connection accepted"; fi

If you use SNI, add the -servername sharewiz.net option to the 2 OpenSSL commands, like so:

openssl s_client -servername snihostname.org -connect 172.16.30.5:443 -ssl    

---

Non-vulnerable website:

echo | timeout 3 openssl s_client -connect sharewiz.net:443 >/dev/null 2>&1; if [[ $? != 0 ]]; then echo "UNKNOWN: sharewiz.net timeout or connection error"; else echo | openssl s_client -connect sharewiz.net:443 -ssl3 2>&1 | grep -qo "sslv3 alert handshake failure\|SSL3_GET_RECORD:wrong version number" && echo "OK: sharewiz.net Not vulnerable" || echo "FAIL:  sharewiz.net vulnerable; sslv3 connection accepted"; fi

result:

OK: sharewiz.net Not vulnerable

Vulnerable site:

echo | timeout 3 openssl s_client -connect sslv3-testhost.com:443 >/dev/null 2>&1; if [[ $? != 0 ]]; then echo "UNKNOWN: sslv3-testhost.com timeout or connection error"; else echo | openssl s_client -connect sslv3-testhost.com:443 -ssl3 2>&1 | grep -qo "sslv3 alert handshake failure\|SSL3_GET_RECORD:wrong version number" && echo "OK: sslv3-testhost.com Not vulnerable" || echo "FAIL:  sslv3-testhost.com vulnerable; sslv3 connection accepted"; fi

result:

FAIL: sslv3-testhost.com vulnerable; sslv3 connection accepted

Site without SSL:

echo | timeout 3 openssl s_client -connect sharewiz.net:443 >/dev/null 2>&1; if [[ $? != 0 ]]; then echo "UNKNOWN: sharewiz.net timeout or connection error"; else echo | openssl s_client -connect sharewiz.net:443 -ssl3 2>&1 | grep -qo "sslv3 alert handshake failure\|SSL3_GET_RECORD:wrong version number" && echo "OK: sharewiz.net Not vulnerable" || echo "FAIL:  sharewiz.net vulnerable; sslv3 connection accepted"; fi

result:

UNKNOWN: sharewiz.net timeout or connection error

You can check other ports by changing 443 to any other valid port.