DROWN

"This server is vulnerable to a DROWN attack. Disable SSLv2 protocol on the server."

Researchers uncovered the DROWN vulnerability in SSL v2. DROWN stands for Decrypting RSA with Obsolete and Weakened eNcryption. It affects HTTPS and other services that rely on the SSL and TLS protocols.

Attackers can use the DROWN vulnerability to break the encryption that is used to protect your sensitive data from prying eyes. If the encryption is broken, attackers can read/steal your sensitive communications (e.g., passwords, financial data, and emails). In some situations, attackers may also be able to impersonate trusted websites.

Although the SSL 2.0 protocol was disavowed in 1996 due to known security flaws, some servers are still using it. Well known vulnerabilities/security flaws:

• Message integrity for export ciphers is weak
• Message integrity is insecure
• Vulnerable to Man-In-The-Middle attack
• Vulnerable to Truncation attack

Disable SSL 2.0 on servers or services that still support SSL v2.

For OpenSSL, the easiest solution is to upgrade to recently released versions of OpenSSL.

If you're still using one of the older (no longer supported) versions of OpenSSL, upgrade to a supported newer version.

If you're using IIS 7 or newer, SSL v2 is disabled by default. If you manually enabled support for SSL v2, go back and disable it. If you are running older (no longer supported) version of IIS, then upgrade to IIS version 7 or newer.

If you are using NSS 3.13 or newer, SSL v2 is disabled by default. If you manually enabled support for SSL v2, you need to go back and disable it. If you are using an older version of NSS, upgrade to NSS 3.13 or newer.

If your servers support SSL v2, disable support for it.