14.4 Preventing POODLE Attack by Disabling SSLv3

If your OpenText eDirectory uses LDAPS protocol with SSLv3 for a secure communication, be aware that SSLv3 is vulnerable to POODLE attack as per CVE-2014-3566.

By default, OpenText eDirectory runs in FIPS mode and does not allow communication over SSLv3. See Configuring eDirectory in FIPS Mode for more information. If you disable FIPS mode for TLS on your OpenText eDirectory server, you may want to disable SSLv3 for LDAP using the following procedure:

Workaround:

  1. Download and install the latest OpenText Identity Console for OpenText eDirectory from the Software License and Download portal.

  2. Launch OpenText Identity Console.

  3. On the OpenText Identity Console home page, click the LDAP Configuration tile.

  4. Select LDAP Server.

  5. On the Modify LDAP Server page > Configuration drop down > select SSLv3 check box.

  6. Click Save.

    NOTE:In a non-English environment, you cannot access the SSLv3 option. To access this option, change the preferred display language to English.

  7. Unload and load the LDAP Services for OpenText eDirectory.

    For more information, see Loading and Unloading LDAP Services for OpenText eDirectory.