OpenSSL cross-Protocol Attack Vulnerability (CVE-2016-0800)

OpenSSL cross-Protocol Attack Vulnerability (CVE-2016-0800)
OpenSSL cross-Protocol Attack Vulnerability (CVE-2016-0800)

Release date:
Updated on:

Affected Systems:

OpenSSL Project OpenSSL <＝1.0.2
OpenSSL Project OpenSSL <= 1.0.1

Unaffected system:

OpenSSL Project OpenSSL 1.0.2g
OpenSSL Project OpenSSL 1.0.1s

Description:

CVE (CAN) ID: CVE-2016-0800

OpenSSL is an open-source SSL implementation that implements high-strength encryption for network communication. It is widely used in various network applications.

OpenSSL 1.0.2 and earlier versions, 1.0.1 and earlier versions have cross-protocol attack vulnerabilities. servers that support SSLv2 and EXPORT encryption components are used as Bleichenbacher RSA padding Oracle attack methods to decrypt TLS sessions. If the supported SSLv2 and EXPORT encryption components share the RSA key of the unaffected server, the traffic between the client and the unaffected server can also be decrypted. This vulnerability is called DROWN.

<* Source: Nimrod Aviram
Sebastian Schinzel

Link: https://www.openssl.org/news/secadv/20160301.txt
*>

Suggestion:

Temporary solution:

If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:

* Disable all SSLv2 keys and EXPORT keys after CVE-2015-3197 vulnerability patches are deployed.

Vendor patch:

OpenSSL Project
---------------
The OpenSSL Project has released a Security Bulletin (20160301) and corresponding patches for this purpose:
20160301: OpenSSL Security Advisory [1st March 2016]
Link: https://www.openssl.org/news/secadv/20160301.txt

For more information about OpenSSL, see the following links:

Use OpenSSL command line to build CA and Certificate

Install OpenSSL in Ubuntu

Provides FTP + SSL/TLS authentication through OpenSSL and implements secure data transmission.

Use OpenSSL to generate certificates in Linux

Use OpenSSL to sign multi-domain certificates

Add a custom encryption algorithm to OpenSSL

OpenSSL details: click here
OpenSSL: click here

This article permanently updates the link address: