• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 919
  • Last Modified:

Classic ASP Website and POODLE

I need some help with POODLE.

I have followed instructions on setting my server up so that it will not use SSL 3.0 by changing the registry and testing it.

My issue is that Authorize.Net says I need to make sure that my shopping cart will not be affected when processing credit card transactions.

My cart is written in classic ASP and uses Server.CreateObject ("MSXML2.ServerXMLHTTP.4.0") to send the request to Authorize.NET for credit card processing.

How do I evaluate my solution to see if it will be a problem?

Thanks!
0
GenesisTech
Asked:
GenesisTech
  • 5
  • 3
2 Solutions
 
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
I received the same email today.  They are talking about the browser and it will only affect people using older IE browsers like ie6 from my understanding.
0
 
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
The copy of that email looks like it is from http://www.authorize.net/support/poodlefaqs/#whattodo 

Microsoft is saying there will be an update https://technet.microsoft.com/en-us/library/security/3009008.aspx

Are you using shared hosting or dedicated/vps?
0
 
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
There is some good answers about server specifics answered http://www.experts-exchange.com/Networking/Protocols/SSL/Q_28539415.html

I have also asked some others for input.
0
How do you know if your security is working?

Protecting your business doesn’t have to mean sifting through endless alerts and notifications. With WatchGuard Total Security Suite, you can feel confident that your business is secure, meaning you can get back to the things that have been sitting on your to-do list.

 
GenesisTechAuthor Commented:
I have a dedicated server.
0
 
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
That link I gave you from MS outlines how to disable sslv3   https://technet.microsoft.com/en-us/library/security/3009008.aspx

Disable SSL 3.0 in Windows
For Server Software
You can disable support for the SSL 3.0 protocol on Windows by following these steps:
Click Start, click Run, type regedt32 or type regedit, and then click OK.
In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
On the Edit menu, click Add Value.
In the Data Type list, click DWORD.
In the Value Name box, type Enabled, and then click OK. 
Note If this value is present, double-click the value to edit its current value.
In the Edit DWORD (32-bit) Value dialog box, type 0 .
Click OK. Restart the computer.
 
Note This workaround will disable SSL 3.0 for all server software installed on a system, including IIS.

Note After applying this workaround, clients that rely only on SSL 3.0 will not be able to communicate with the server.
 
For Client Software
You can disable support for the SSL 3.0 protocol on Windows by following these steps:
Click Start, click Run, type regedt32 or type regedit, and then click OK.
In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
On the Edit menu, click Add Value.
In the Data Type list, click DWORD.
In the Value Name box, type Enabled, and then click OK. 
Note If this value is present, double-click the value to edit its current value.
In the Edit DWORD (32-bit) Value dialog box, type 0 .
Click OK. Restart the computer.
 
Note This workaround will disable SSL 3.0 for all client software installed on a system.

Note After applying this workaround, client applications on this machine will not be able to communicate with other servers that only support SSL 3.0.

Open in new window

0
 
GenesisTechAuthor Commented:
Scott and others.

I have followed the link's instructions and I get that already. My understanding is that the link refers to handling INBOUND web requests and how my server will respond to them.

My concern has to do with OUTBOUND payment processing requests. Authorize.NET specifically states that you need to make sure your Shopping Cart software will not have a problem submitting and processing a transaction request to Authorize.NET. How do I determine what protocol my shopping cart uses when sending out the request and whether it will work with Authorize.NET or not?
0
 
GaryCommented:
No points for this as Scott has already answered it.
All you need do is disable SSLv3 on your server - end of, nothing else to do, carry on with your life.
0
 
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
If SSLv3 is not available on the server, it can't be used.  

I didn't have to do anything for my own server. Check this out for your own
https://www.ssllabs.com/ssltest/index.html
0
 
GenesisTechAuthor Commented:
OK. I appreciate the help.

I guess I was confused because Authorize.NET made it sound like there were 2 very distinct actions that needed to be taken.
1) To make sure your server no longer supported SSL3 for incoming requests....AND
2) To make sure your transaction processing request being sent to Authorize.NET would be in compliance as well.

If fixing the server fixes both for me, than I guess I am all set.

Thanks guys!!!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Live Q & A: Securing Your Wi-Fi for Summer Travel

Traveling this summer? Join us on June 18, 2018 for a live stream to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now