Please Advise - My ISP just reported that I have a POODLE vulnerability

My Cloud OS 3 Personal & Network Attached Storage My Cloud
1

My ISP just reported that I have a POODLE vulnerability as uPnP has a Port Forwarding rule for Port 443.
I have MYCloud Firmware V04.05.00-237 which should have the Poodle Fix.
Do I need to do anything?
Advice would be appreciated

192.168.0.16 443 9444 TCP Automatically added by UPnP

2

Ok, with a V04 firmware this is a Gen2.

In a nut-shell, you want to make sure anything and everything that communicates over SSL, does so using protocols newer then SSL3.

Sadly, doing that means you need a user init script, like wd_crack-- or abusing the cron tab. This is because, WD, in their INFINITE WISDOM (sarcasm) placed all the config files into a read only cramfs container, AND, the root filesystem of the unit is hosted by a ramdisk.

Your user init script needs to ensure that the lines:

SSLEngine On
SSLProtocol all -SSLv2 -SSLv3

appear inside the following conf files:

  • /usr/sbin/lightly_ssl
  • /usr/local/apache2/conf/mods-enabled/ssl.conf
  • /usr/local/apache2_dav/conf/extra/httpd-ssl.conf

then stop apache’s daemon, and restart it.

You can accomplish this by keeping persistent copies of these files on the data volume, then deleting those files at those locations, and then creating symbolic links at those locations that point toward your persistent edited copies of those files.

The CORRECT solution is for WD to release a new firmware that contains the revisions, but since this product line is End Of Life, I seriously doubt that is going to happen.

3

Many thanks - appreciated. I’ll have a go.
Mike

4

Wait… Again, I need to not give advice when dead ass tired.

v4 firmware is gen1. It has proper storage. just update the files with the changes and reboot. dont delete them.