They then create multiple connections to the server using the cross-protocol vulnerability. These sessions can either be intercepted over time, or attackers may be able to trick users into following a link that creates such connections in the background without the user’s knowledge.Īt the second stage of the attack, the attacker has captured the usual client/server handshake. The researchers who announced the DROWN vulnerability estimated that about 1,000 such sessions are sufficient for the subsequent description of the session key. Eventually, one of these recorded sessions will be decrypted.

For DROWN to work, these sessions must also use RSA cipher suites. First, the attacker must observe and record sessions between the server and the client that use any version of SSL or TLS. The DROWN attack goes through several stages. As a result, the latter attack is significantly easier, cheaper, and faster to execute. The general DROWN makes use of the RSA encryption of the master secret in SSLv2, whereas the special DROWN makes use of an OpenSSL vulnerability in its implementation of SSLv2. There are two main types of DROWN attack – a general DROWN attack and a special DROWN attack. As a result, all servers are at risk, including websites and mail servers. Due to the nature of the server’s responses when using an RSA key exchange under SSLv2, the attacker can slowly begin to gather pieces of the server’s session key, eventually revealing them entirely.

Once the attacker has exploited the cross-protocol vulnerability, they send thousands of modified handshake messages to the server and monitor its responses. It is also a Bleichenbacher padding oracle attack (i.e., a ciphertext attack). On the one hand, it is a cross-protocol attack which means that part of its strategy is to make use of differences in protocols to exploit a particular vulnerability present in the SSLv2 protocol. The full technical description of the attack is available in the DROWN: Breaking TLS using SSLv2 paper.ĭROWN uses several different tactics to achieve its goal. The DROWN attack was officially announced by a group of security researchers in March 2016 and was assigned CVE-2016-0800. CVSS Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N SSL DROWN Vulnerability Information

How to use nessus drown detection