Threat Level: green Handler on Duty: Renato Marinho

SANS ISC: Exploit o' the day: DROWN - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Exploit o' the day: DROWN

Details about a new vulnerability related to SSL and TLS, entitled Decrypting RSA with Obsolete and Weakened eNcryption, or DROWN, have surfaced that takes advantage of a weakness in SSLv2.  The most significant impact of this vulnerability to date relates to OpenSSL, which released an update today that addresses this vulnerability, and several others.  The US-CERT published a notification today as well, stating "Network traffic encrypted using an RSA-based SSL certificate may be decrypted if enough SSLv2 handshake data can be collected."   Microsoft IIS version 7.0 and greater is not impacted, as SSLv2 is disabled by default; unless it has been enabled as part of the deployment, which should be identified during vulnerability testing.  

 

While secure default configurations, patches, and updates will often address the technical shortcomings in applications and libraries, it will not address architectural issues where integrations exist which rely on older encryption methods.  Organizations that rely on SSLv2 for integrations may want to consider an enterprise effort to finally make the move, and eliminate the risk entirely. 

 

Additional details

DROWN Attack Paper

US-CERT Post

tony d0t carothers --gmail

Tony

150 Posts
ISC Handler
If we could stop giving vulnerabilities websites, logos, and tortured acronyms that'd be great.
Anonymous

Posts
Computerworld pointed to a website where you can check if a site is vulnerable to DROWN; Computerworld article:
http://www.computerworld.in/news/new-tls-decryption-attack-affects-one-three-servers-due-legacy-sslv2-support

"To check whether your server appears to be vulnerable, enter the domain or IP address:"
https://drownattack.com/#test

So far, of the few sites I just checked: 2-of-3 financial institutions, one e-commerce site, and a couple of others all were at risk; only a handful of sites seemed to be safe for now. Hopefully that changes very soon...
Anonymous

Posts
Yeah, let's go back to the days when we didn't talk about vulnerabilities/exploits hoping nobody would find out about them!
3RCC

2 Posts Posts
Has anyone come up with effective Snort rules for this yet?
3RCC

2 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!