Re: Mulberry, SSLv3 and POODLE

Hi Christer,

--On October 18, 2014 at 5:49:08 PM +0200 Christer Mjellem Strand 
<[email protected]> wrote:

> As I'm sure you've all heard, this week's OpenSSL POODLE[1] vulnerability
> has caused sysadmins worldwide to scramble to disable SSLv3 on their
> servers. Although in the bigger picture this is probably a good thing,
> for Mulberry it causes a bit of trouble, since it supports TLS with
> STARTTLS, but otherwise only SSLv3 and SSLv23. Most IMAP and SMTP servers
> thankfully support STARTTLS, but no such luck with CalDAV, CardDAV or
> LDAP.
>
> In order to continue remaining functional, Mulberry will have to work
> with TLSv1. Ideally it should simply use the system OpenSSL libs without
> too much magic inbetween (which could allow for TLSv12, elliptic curve
> and such nice things), but at a bare minimum, TLSv1 needs to work.
>
> Anyone else hit by this? Anyone already working on it? Anyone up for the
> task?
>
> (I am not a developer, unfortunately)

A code change is needed to make it work properly. However, if you are using 
a local preferences file what you can do is grep that file for the string 
"SSLv3Real" and change that to "TLSv1". That will trick Mulberry into using 
the "STARTTLS - TLSv1" option that is otherwise disabled in the preferences 
dialog.

For anyone wanting to tweak the code, here is the diff I am currently using 
(note line numbers will be way off as I have some other uncommitted changes 
in that file right now - but the general approach is to switch to the v23 
method to use all the time but use the SSL_OP_NO_XXX to turn of the 
undesirable methods):

Index: Mulberry/Sources_Common/Mail/Network/CTLSSocket.cp
===================================================================
--- CTLSSocket.cp	(revision 491)
+++ CTLSSocket.cp	(working copy)@@ -477,11 +617,9 @@
 		{
 			case 1:
 			case 4:
+            case 2:
 				m_ctx = ::SSL_CTX_new(::SSLv23_client_method());
 				break;
-			case 2:
-				m_ctx = ::SSL_CTX_new(::SSLv3_client_method());
-				break;
 			case 3:
 				m_ctx = ::SSL_CTX_new(::TLSv1_client_method());
 				break;
@@ -493,7 +631,7 @@
 		}

 		// Work around all known bugs
-	    ::SSL_CTX_ctrl(m_ctx, SSL_CTRL_OPTIONS, SSL_OP_ALL, NULL);
+	    ::SSL_CTX_ctrl(m_ctx, SSL_CTRL_OPTIONS, SSL_OP_ALL | SSL_OP_NO_SSLv2 
| SSL_OP_NO_SSLv3, NULL);


-- 
Cyrus Daboo