R12.1: Enabling TLS in Oracle EBS

Read up on MOS article 376700.1 to learn how to start working on "Enabling TLS in Oracle E-Business Suite Release 12.1" for your environment today so you can get away from SSL as many third party vendors are going away from SSL due to all of the issues like POODLE.

POODLE and Oracle Linux

Now you might be saying "hey you already showed us this document" but not only has it been updated in the last week, it has some new tools for our toolbox!  Revisit MOS article "ALERT - Mitigating the SSLv3 “POODLE” Vulnerability in Oracle Linux (CVE-2014-3566)" via note ID 1940202.1 and find out how to use command line checks to verify what SSL versions are being used!  Why is this useful?  Well what if you wanted to make one file that dials out to all your servers just to gather data about them?  It would be nice to know if they were potentially vulnerable to something like this, right?  Now you can if you run these commands!

Of course this also has detailed steps, patches, and setups required to turn off SSL for many different types of software!

POODLE vulnerability and Oracle products

By now you have likely heard about the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability issue facing SSL v3.0 communications, but do you know how to find out if your Oracle applications have patches released?  Follow this link to the OTN document which is keeping track of what is affected with patches available, likely vulnerable without fixes available, products not affected and those that are still being researched.  Did you know that this is so important Visa's Cybersource credit card processing platform is disabling SSL v3.0 next week to prevent malicious activities?

As a bonus, check out the article on OTN for disabling SSL v3.0 in the Oracle JDK and JRE platforms!