DROWN Vulnerability

We would like to bring to your attention the latest SSL/TLS vulnerability known as the DROWN (Decrypting RSA using Obsolete and Weakened eNcryption) attack¹. Although there is much hype around such vulnerabilities it is rated as important and seems serious enough for us to send out this alert particularly as the tester identifies weak SSL configurations / vulnerable library versions which may be subject to other vulnerabilities.

For more information

• drownattack.com/

Recommendation

Test your site(s) here and mitigate if vulnerable:

• test.drownattack.com/

Generally mitigation involves disabling support for SSLv2 and possibly updating SSL libraries (e.g. OpenSSL). Shared keys/certificates with a vulnerable server also presents risk. For more specific directions please consult your specific OS reference (e.g.²).

Further reading

• news.softpedia.com/news/a-third-of-all-https-websites-are-vulnerable-to-the-drown-attack-501202.shtml

References

¹CVE-2016-0800: Vulnerability Summary

²Red Hat: DROWN – Cross-protocol attack on TLS using SSLv2