March 3, 2016 By Larry Loeb 2 min read

OpenSSL is a cryptographic library used in many server products. But organizations should be advised that the library has a vulnerability, recently announced by the maintainers of the OpenSSL library, called DROWN, or Decrypting RSA with Obsolete and Weakened Encryption. It is also tracked by CVE-2016-0800. This was first reported to the library on Dec. 29, 2015, by security researchers who also published an official paper on the vulnerability.

Support Leads to Vulnerability

The vulnerability centers around the now-obsolete protocol SSLv2, a 1990s-era predecessor to TLS. Modern servers and clients almost uniformly use the TLS encryption protocol. SSLv2 was known to be insecure, but having support for it in OpenSSL was not thought to be harmful to security since it was so rarely used.

That assumption was wrong. Simply having SSLv2 support present in OpenSSL opens it up to the DROWN vulnerability. The vulnerability can enable the attacker to decrypt the TLS connections between up-to-date clients and servers if certain other conditions are met.

DROWN works by probing a server that supports SSLv2 and uses the same private key as TLS servers and clients. Using the same security certificate on two different servers means they will share the same private key.

OpenSSL Attacks Stem From Certificate Issues

This is a more common situation than it appears at first glance. Many companies will reuse the same certificate (and hence private key) on their Web and email servers. In this case, the email server may support SSLv2, but the Web server will not. An attacker can find the key of the email server via DROWN and then use it to decrypt the TLS connections to the Web server.

The authors of the DROWN paper found that this is not an expensive or particularly strenuous attack to perform. “A typical scenario requires the attacker to observe 1,000 TLS handshakes, then initiate 40,000 SSLv2 connections and perform 2 to the 50th power offline work to decrypt a 2048-bit RSA TLS ciphertext,” the researchers said.

They went on to note that they decrypted a TLS 1.2 handshake using 2048-bit RSA for $440 in less than eight hours.

Mitigation and Resolution

An Internet scan by the researchers showed that more than 2.3 million HTTPS servers with browser-trusted certificates are vulnerable to DROWN, SecurityWeek reported. But disabling SSLv2 support may be rather hard. It could already be embedded in products that are in use. Fortunately, Microsoft IIS (version 7 and above) and the Network Security Services (NSS) library (versions 3.13 and above) have SSLv2 support disabled by default.

A tool to see if a server is vulnerable to DROWN is available; all users have to do is type the server name or IP address into a dialog box.

OpenSSL 1.0.2g and 1.0.1s, which disable SSLv2 by default at build time, have been released. These versions also ensure that it’s impossible to configure a TLS server improperly, preventing DROWN from becoming an issue.

Client-side software such as browsers cannot take any action to mitigate this risk. Only a server can change the software needed to fix this, but it’s certainly a worthwhile effort.

More from

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy.After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security of…

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today