Re: Mulberry, SSLv3 and POODLE

Hi Cyrus, thanks for responding so quickly.

>> As I'm sure you've all heard, this week's OpenSSL POODLE[1]
>> vulnerability has caused sysadmins worldwide to scramble to
>> disable SSLv3 on their servers. Although in the bigger picture
>> this is probably a good thing, for Mulberry it causes a bit of
>> trouble, since it supports TLS with STARTTLS, but otherwise only
>> SSLv3 and SSLv23. Most IMAP and SMTP servers thankfully support
>> STARTTLS, but no such luck with CalDAV, CardDAV or LDAP.
>>
>> In order to continue remaining functional, Mulberry will have to
>> work with TLSv1. Ideally it should simply use the system OpenSSL
>> libs without too much magic inbetween (which could allow for
>> TLSv12, elliptic curve and such nice things), but at a bare
>> minimum, TLSv1 needs to work.
>>
>> Anyone else hit by this? Anyone already working on it? Anyone up
>> for the task?
>>
>> (I am not a developer, unfortunately)
>
> A code change is needed to make it work properly. However, if you
> are using a local preferences file what you can do is grep that
> file for the string "SSLv3Real" and change that to "TLSv1". That
> will trick Mulberry into using the "STARTTLS - TLSv1" option that
> is otherwise disabled in the preferences dialog.

I tried this before posting, and while this does seem to work in terms 
of forcing it to use STARTTLS - TLSv1, unfortunately this doesn't 
really help since the protocols affected are the same ones that don't 
use STARTTLS (HTTP et al).

David R Bosso kindly tipped me off off-list however that the SSLv23 
method, where available, does include TLSv1. This has fixed the problem 
for me in Linux, where Mulberry is built against a relatively recent 
version of OpenSSL. In Windows (using 4.0.8), however, only the 
STARTTLS - TLSv1 and SSLv3 optons are available - not the SSLv23 option.

> For anyone wanting to tweak the code, here is the diff I am
> currently using (note line numbers will be way off as I have some
> other uncommitted changes in that file right now - but the general
> approach is to switch to the v23 method to use all the time but use
> the SSL_OP_NO_XXX to turn of the undesirable methods):
[..]

Thanks for that - I'll be sure to include these the next time I 
rebuild. I also intend to play around with TLS Interposer[1], which I'm 
already using for several pieces of server-based software that lack 
configurable ciphers. Looking at its source, it seems to me the 
necessary changes to add support for ECDHE ciphers would be a matter of 
a few lines, which would seem a worthwhile effort for someone touching 
this code.

This still leaves the Windows version though - I wouldn't have a clue 
where to even begin trying to build that myself.. :| The last time I 
tried the 4.0.9a1 version I quickly ran into installer problems and 
reverted - would that version perhaps include changes that would allow 
the SSLv23 option to be used?
If not, are there any plans to make a rebuilt Windows download 
available? Does anyone even have a functioning development environment 
for Mulberry in Windows anymore? :}

Thanks again.

[1] <https://netfuture.ch/tools/tls-interposer/>

-- 
  -==-                  -=-                  -==-
   Christer Mjellem Strand               yitzhaq
   System administrator             ICQ: 9557698
   GSM: +47 922 000 12    JID: [email protected]
  -==-                  -=-                  -==-