Question

During an internal assessment, your automated scanner reports that a web server on port 8443 is vulnerable to a critical POODLE (CVE-2014-3566) SSLv3 downgrade attack. The client is skeptical because they claim SSLv3 was disabled last year. Before including this in the report, which action MOST reliably confirms whether the finding is a genuine vulnerability or a false positive?

Accepted Answer

Manually negotiate a connection to the service using an SSLv3-forced handshake (e.g., openssl s_client -ssl3 -connect host:8443) to verify whether the protocol is actually accepted

Answer

Re-run the same scanner with the plugin severity threshold raised so the finding is filtered out of the report

Answer

Search Exploit-DB for a working POODLE proof-of-concept and note its availability in the report

Answer

Compare the reported CVSS base score against the client's asserted patch date and drop the finding if the dates conflict