DROWN

Decrypting RSA using Obsolete and Weakened eNcryption

"This server is vulnerable to a DROWN attack. Disable SSLv2 protocol on the server."

Problem

Researchers uncovered the DROWN vulnerability in SSL v2. DROWN stands for Decrypting RSA with Obsolete and Weakened eNcryption. It affects HTTPS and other services that rely on the SSL and TLS protocols.

Attackers can use the DROWN vulnerability to break the encryption that is used to protect your sensitive data from prying eyes. If the encryption is broken, attackers can read/steal your sensitive communications (e.g., passwords, financial data, and emails). In some situations, attackers may also be able to impersonate trusted websites.

Although the SSL 2.0 protocol was disavowed in 1996 due to known security flaws, some servers are still using it. Well known vulnerabilities/security flaws:

  • Message integrity for export ciphers is weak
  • Message integrity is insecure
  • Vulnerable to Man-In-The-Middle attack
  • Vulnerable to Truncation attack

Solution

Disable SSL 2.0 on servers or services that still support SSL v2.

OpenSSL

For OpenSSL, the easiest solution is to upgrade to recently released versions of OpenSSL.

If you're still using one of the older (no longer supported) versions of OpenSSL, upgrade to a supported newer version.

Microsoft IIS

If you're using IIS 7 or newer, SSL v2 is disabled by default. If you manually enabled support for SSL v2, go back and disable it. If you are running older (no longer supported) version of IIS, then upgrade to IIS version 7 or newer.

Network Security Services (NSS)

If you are using NSS 3.13 or newer, SSL v2 is disabled by default. If you manually enabled support for SSL v2, you need to go back and disable it. If you are using an older version of NSS, upgrade to NSS 3.13 or newer.

Apache, Nginx, etc.

If your servers support SSL v2, disable support for it.

About

DigiCert is the world’s premier provider of high—assurance digital certificates—providing trusted SSL, private and managed PKI deployments, and device certificates for the emerging IoT market. Since our founding almost fifteen years ago, we’ve been driven by the idea of finding a better way. A better way to provide authentication on the internet. A better way to tailor solutions to our customer’s needs. Now, we’ve added Symantec’s experience and talent to our legacy of innovation to find a better way to lead the industry forward, and build greater trust in identity and digital interactions.

©2019 DigiCert, Inc. All rights reserved. DigiCert and its logo are registered trademarks of DigiCert, Inc. Symantec and Norton and their logos are trademarks used under license from Symantec Corporation. Other names may be trademarks of their respective owners.