TLS POODLE

[DanAvni]

I have set my VIPs to only allow TLS 1.0 as the minimum to help fight against SSL v3 POODLE

as instructed by http://www.fortiguard.com/advisory/SSL-v3--POODLE--Vulnerability/

but as of last week the same problem has been found in TLS 1.0

"On Dec. 8, researchers found that the POODLE flaw also extends to certain versions of a widely used SSL-like encryption standard known as TLS (short for Transport Layer Security)." (taken from http://krebsonsecurity.com/2014/12/poodle-bug-returns-bites-big-bank-sites/ )

what should be set to prevent the same on TLS?

[neonbit]

If you want to disable TLS 1.0 for your SSLVPN portal you can use the following:

config vpn ssl settings
set tlsv1-0 disable
end

If you want to disable TSL 1.0 for your admin webGUI certificate you can use the following:

config system global
set admin-https-ssl-versions tlsv1-1 tlsv1-2
end

[journeyman]

Note that the new vulnerability is not related to TLS itself but to implementations of TLS. It includes TLSv1.x, not just 1.0

I haven't checked since last week but at the time only two vendors had known vulnerable implementations (f5 and A10). See for example here