CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.3 | $0-$5k | 0.00 |
A vulnerability was found in OpenSSL up to 1.0.1r/1.0.2f (Network Encryption Software). It has been declared as critical. Affected by this vulnerability is an unknown part of the component SSLv2 Handler. The manipulation with an unknown input leads to a cryptographic issues vulnerability (DROWN). The CWE definition for the vulnerability is CWE-310. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
The weakness was presented 03/01/2016 by Nimrod Aviram and Sebastian Schinzel as 20160301.txt as confirmed advisory (Website). The advisory is shared at openssl.org. The public release was coordinated in cooperation with the project team. This vulnerability is known as CVE-2016-0800 since 12/16/2015. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1600 for this issue. The advisory points out:
cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN (CVE-2016-0800).
After immediately, there has been an exploit disclosed. It is possible to download the exploit at drownattack.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 63 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 89082 (OpenSSL 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Web Servers and running in the context r. The commercial vulnerability scanner Qualys is able to test this issue with plugin 168833 (OpenSuSE Security Update for libopenssl0_9_8 (openSUSE-SU-2016:1241-1)). The advisory illustrates:
Recovering one session key requires the attacker to perform approximately 2^50 computation, as well as thousands of connections to the affected server. A more efficient variant of the DROWN attack exists against unpatched OpenSSL servers using versions that predate 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf released on 19/Mar/2015 (see CVE-2016-0703 below).
Upgrading to version 1.0.1s or 1.0.2g eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:
Users can avoid this issue by disabling the SSLv2 protocol in all their SSL/TLS servers, if they've not done so already. Disabling all SSLv2 ciphers is also sufficient, provided the patches for CVE-2015-3197 (fixed in OpenSSL 1.0.1r and 1.0.2f) have been deployed. Servers that have not disabled the SSLv2 protocol, and are not patched for CVE-2015-3197 are vulnerable to DROWN even if all SSLv2 ciphers are nominally disabled, because malicious clients can force the use of SSLv2 with EXPORT ciphers.
The vulnerability is also documented in the databases at X-Force (111139) and Tenable (89082). Additional details are provided at access.redhat.com. See 81112, 81142, 81143 and 81144 for similar entries.
Product
Type
Name
Version
- 1.0.1a
- 1.0.1b
- 1.0.1c
- 1.0.1d
- 1.0.1e
- 1.0.1f
- 1.0.1g
- 1.0.1h
- 1.0.1i
- 1.0.1j
- 1.0.1k
- 1.0.1l
- 1.0.1m
- 1.0.1n
- 1.0.1o
- 1.0.1p
- 1.0.1q
- 1.0.1r
- 1.0.2
- 1.0.2a
- 1.0.2b
- 1.0.2c
- 1.0.2d
- 1.0.2e
- 1.0.2f
License
Support
- end of life (old version)
CPE 2.3
CPE 2.2
Video
Youtube: Not available anymoreCVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.9VulDB Meta Temp Score: 5.6
VulDB Base Score: 5.9
VulDB Temp Score: 5.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.9
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Name: DROWNClass: Cryptographic issues / DROWN
CWE: CWE-310
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 89082
Nessus Name: OpenSSL 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 14611
OpenVAS Name: Amazon Linux Local Check: alas-2016-682
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍
Upgrade: OpenSSL 1.0.1s/1.0.2g
McAfee IPS: 🔍
McAfee IPS Version: 🔍
Fortigate IPS: 🔍
Timeline
12/16/2015 🔍12/29/2015 🔍
03/01/2016 🔍
03/01/2016 🔍
03/01/2016 🔍
03/01/2016 🔍
03/01/2016 🔍
03/01/2016 🔍
03/02/2016 🔍
03/02/2016 🔍
03/02/2016 🔍
03/16/2016 🔍
02/01/2019 🔍
Sources
Product: openssl.orgAdvisory: 20160301.txt
Researcher: Nimrod Aviram, Sebastian Schinzel
Status: Confirmed
Confirmation: 🔍
Coordinated: 🔍
CVE: CVE-2016-0800 (🔍)
OVAL: 🔍
X-Force: 111139 - OpenSSL TLS security bypass
SecurityTracker: 1035133
Vulnerability Center: 57345 - OpenSSL Remote Security Bypass via TLS Chipertext Data Decryption - CVE-2016-0800, Medium
SecurityFocus: 83733 - OpenSSL DROWN Attack CVE-2016-0800 Security Bypass Vulnerability
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍
See also: 🔍
Entry
Created: 03/02/2016 13:52Updated: 02/01/2019 14:35
Changes: 03/02/2016 13:52 (99), 02/01/2019 14:35 (16)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.