The Internet Storm Center has excellent resources on the new POODLE vulnerability which can greatly compromise encrypted sessions for the legacy SSLv3 protocol under the right circumstances

https://isc.sans.edu/diary/SSLv3+POODLE+Vulnerability+Official+Release/18827

https://isc.sans.edu/diary.html?storyid=18837

https://technet.microsoft.com/en-us/library/security/3009008.aspx

QUOTE: Finally we got an official announcement. SSLv3 had issues in the past. Remember the BEAST attack? It was never resolved (other then moving to TLS 1.1/2). The only alternative was to use a stream cipher like RC4, which had its own problems.

But this POODLE issue is different. With block ciphers, we have a second problem: What if the block to be encrypted is too short? In this case, padding is used to make up for the missing data. Since the padding isn’t really considered part of the message, it is not covered by the MAC (message authorization code) that verified message integrity.

So what does this mean in real live? The impact is similar to the BEAST attack. An attacker may either play MitM, or may be able to decrypt parts of a message if the attacker is able to inject data into the connection just like in the BEAST attack. The attack allows one to decrypt one byte at a time, if the attacker is able to inject messages right after that byte that include only padding.

What should you do: Disable SSLv3. There is no patch for this. SSLv3 has reached the end of its useful life and should be retired. This isn’t a “patch now”. Give it some time, test it carefully, but get going with it. The other problem is that this is a client and a server issue. You need to disable SSLv3 on either. Start with the servers for highest impact, but then see what you can do about clients.