Question

During an internal assessment, your automated scanner flags a web application server as vulnerable to the POODLE attack (CVE-2014-3566) with a HIGH severity rating. Before including this finding in your report, you want to eliminate the possibility of a false positive. Which action most directly confirms whether this vulnerability is genuinely present?

Accepted Answer

Manually negotiate a connection using openssl s_client with the -ssl3 flag to verify the server actually accepts an SSLv3 handshake

Answer

Re-run the same scanner with credentialed access to increase the accuracy of the plugin output

Answer

Check the server's HTTP response headers for a Server banner indicating an old web server version

Answer

Search Exploit-DB for a public proof-of-concept and confirm one exists for CVE-2014-3566