SSLv2 "DROWN" Vulnerability Disclosed

[phoronix]

Phoronix: SSLv2 "DROWN" Vulnerability Disclosed

A major vulnerability was made public this morning that concerns SSLv2...

http://www.phoronix.com/scan.php?page=news_item&px=SSLv2-DROWN-Vulnerability

[Veerappan]

I knew there was something ominous about the libssl update this morning when I updated my work laptop...

[AnonymousCoward]

What is the problem? Shouldn't be all SSL2/3 connections been disabled for years now?

[Veerappan]

What is the problem? Shouldn't be all SSL2/3 connections been disabled for years now?

SSL3 should be disabled because it's just plain busted, but SSL2 is still in common use in the wild for system-to-system communication, and probably in plenty of browser connections as well.

[cmr~]

What is the problem? Shouldn't be all SSL2/3 connections been disabled for years now?

You should read the paper or the website. It's a somewhat complex cross-protocol attack, and they demonstrate . Importantly, it applies whenever the private key material is shared, not just when the same certificate is used. Mentioned in the paper, but unfortunately not by Michael's summary, is that it affects 22% of all webservers. See the paper for details.

[carewolf]

SSL3 should be disabled because it's just plain busted, but SSL2 is still in common use in the wild for system-to-system communication, and probably in plenty of browser connections as well.

No SSLv3 was broken recently and still in use in old hardware. SSLv2 was broken some 15-20 years ago, and has been deprecated and unused for just as long.