SSLv2 "DROWN" Vulnerability Disclosed
Written by Michael Larabel in Free Software on 1 March 2016 at 08:34 AM EST. 5 Comments
FREE SOFTWARE --
A major vulnerability was made public this morning that concerns SSLv2.

DROWN is the name for this new SSLv2 woe and is short for Decrypting RSA using Obsolete and Weakened eNcryption. This is a man-in-the-middle attack against servers running TLS for secure communication. DROWN is officially known as cve-2016-0800 where it's explained as, "A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN."

DROWNAttack.com was setup to provide more details on this latest high profile, open-source security issue. There are also more details via the Red Hat Security Blog.
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Free Software News
Popular News