DROWN (CVE-2016-0800)
DROWN showed that obsolete SSLv2 support on a server could endanger modern TLS traffic, including traffic handled by another service sharing the same key. It reinforced the need to remove legacy protocols across an entire key-management estate.
DROWN, short for Decrypting RSA with Obsolete and Weakened eNcryption, is CVE-2016-0800. It is a cross-protocol attack involving servers that support the obsolete SSLv2 protocol.
Research
The research team showed that SSLv2 could act as a Bleichenbacher RSA padding oracle. Under the documented conditions, the oracle could be used to decrypt passively collected TLS sessions using a shared RSA key.
The victim client did not need to use SSLv2. This made server-side legacy protocol support and key reuse the important exposure conditions.
Response
Operators were advised to disable SSLv2 and avoid using the same RSA certificate key on services with differing protocol configurations. The work was published at the 2016 USENIX Security Symposium.
Timeline
- 2016-03-01The DROWN research team publicly discloses the attack.
- 2016The DROWN paper is presented at the 25th USENIX Security Symposium.
DROWN (CVE-2016-0800)
- Type
- Vulnerability / Discovery
- Era
- 2016
- Key date
- 2016-03-01
- Tags
- drown, tls, sslv2, cve-2016-0800, rsa, cross-protocol
Created by Joas A Santos · Something wrong or want it removed? Open an issue.