OpenSSL is a cryptographic library used in many server products. But organizations should be advised that the library has a vulnerability, recently announced by the maintainers of the OpenSSL library, called DROWN, or Decrypting RSA with Obsolete and Weakened Encryption. It is also tracked by CVE-2016-0800. This was first reported to the library on Dec. 29, 2015, by security researchers who also published an official paper on the vulnerability.

Support Leads to Vulnerability

The vulnerability centers around the now-obsolete protocol SSLv2, a 1990s-era predecessor to TLS. Modern servers and clients almost uniformly use the TLS encryption protocol. SSLv2 was known to be insecure, but having support for it in OpenSSL was not thought to be harmful to security since it was so rarely used.

That assumption was wrong. Simply having SSLv2 support present in OpenSSL opens it up to the DROWN vulnerability. The vulnerability can enable the attacker to decrypt the TLS connections between up-to-date clients and servers if certain other conditions are met.

DROWN works by probing a server that supports SSLv2 and uses the same private key as TLS servers and clients. Using the same security certificate on two different servers means they will share the same private key.

OpenSSL Attacks Stem From Certificate Issues

This is a more common situation than it appears at first glance. Many companies will reuse the same certificate (and hence private key) on their Web and email servers. In this case, the email server may support SSLv2, but the Web server will not. An attacker can find the key of the email server via DROWN and then use it to decrypt the TLS connections to the Web server.

The authors of the DROWN paper found that this is not an expensive or particularly strenuous attack to perform. “A typical scenario requires the attacker to observe 1,000 TLS handshakes, then initiate 40,000 SSLv2 connections and perform 2 to the 50th power offline work to decrypt a 2048-bit RSA TLS ciphertext,” the researchers said.

They went on to note that they decrypted a TLS 1.2 handshake using 2048-bit RSA for $440 in less than eight hours.

Mitigation and Resolution

An Internet scan by the researchers showed that more than 2.3 million HTTPS servers with browser-trusted certificates are vulnerable to DROWN, SecurityWeek reported. But disabling SSLv2 support may be rather hard. It could already be embedded in products that are in use. Fortunately, Microsoft IIS (version 7 and above) and the Network Security Services (NSS) library (versions 3.13 and above) have SSLv2 support disabled by default.

A tool to see if a server is vulnerable to DROWN is available; all users have to do is type the server name or IP address into a dialog box.

OpenSSL 1.0.2g and 1.0.1s, which disable SSLv2 by default at build time, have been released. These versions also ensure that it’s impossible to configure a TLS server improperly, preventing DROWN from becoming an issue.

Client-side software such as browsers cannot take any action to mitigate this risk. Only a server can change the software needed to fix this, but it’s certainly a worthwhile effort.