OpenSSL update fixes Drown vulnerability

The Drown attack decrypts TLS sessions on servers supporting SSL v2 and victimisation RSA key exchange.

An international team of researchers has uncovered AN attack that may compromise encrypted network traffic in a very matter of hours.

The Drown (Decrypting RSA with Obsolete and Weakened Encryption) attack with success decrypts TLS (transport layer security) sessions by exploiting a vulnerability within the older SSL v2 protocol that exposes personal RSA keys. Once again, recent cryptography is breaking the protection of all on-line communications.

Drown is totally different from different attacks against TLS therein it does not would like servers to be victimisation the older version; the attack can succeed as long because the targeted system supports SSL v2. The cross-protocol attack (CVE-2016-0800) could lead on to coding of any encrypted session victimisation SSL/TLS protocols as long because the server supports SSL v2 and uses RSA key exchange, the researchers aforesaid in their technical paper.

By creating recurrent SSL v2 association requests, researchers uncovered bits of knowledge concerning the server's personal RSA key. when enough requests, researchers were ready to acquire the personal key to rewrite the TLS sessions. The attack scope widens if the organization reuses that non-public RSA key across servers, though totally different certificates area unit used.

SSL v2, free in 1995 and retired but a year later as a result of incapacitating weaknesses, is sufficiently old that it's unlikely anyone remains victimisation this version. Browsers and email shoppers do not support SSL v2, however several servers and networking devices do. If a laptop specifically requested to determine a SSL v2 session, those servers would switch to the vulnerable protocol rather than victimisation the default, and safer, TLS.

"For a few years, the argument for not disabling SSL v2 was that there was no hurt as a result of no browsers used it anyway," aforesaid Ivan Ristic, director of engineering at Qualys.

Drown illustrates the folly of that thinking, since obsolete cryptography is dangerous though it's not actively getting used. All directors have to be compelled to right away disable SSL v2 on all their servers.

The attack is created worse by 2 extra implementation vulnerabilities in OpenSSL, prompting the project team to unleash versions one.0.2g and 1.0.1s to deal with the problems.
The issue with OpenSSL

OpenSSL versions one.0.2, 1.0.1l, 1.0.0q, 0.9.8ze, and earlier have a vulnerability that produces it easier to run a less expensive and a lot of economical version of Drown (CVE 2016-0703 and CVE 2016-0704). within the general attack situation, the offender targeting a vulnerable server would want to watch one,000 TLS handshakes, initiate forty,000 SSLv2 connections, and perform 250 offline work to rewrite a 2048-bit RSA TLS cipher-text. On systems running vulnerable versions of OpenSSL, the offender will acquire a key for one out of 260 TLS connections when running concerning seventeen,000 probe connections. The computation takes but a moment on a quick computer.

"If the conditions area unit right, an equivalent SSL v2 flaw is used for time period MITM attacks and even against servers that do not support the RSA key exchange the least bit," Ristic aforesaid.

OpenSSL versions one.0.2a, 1.0.1m, 1.0.0r, and 0.9.8zf free in March 2015 and later aren't susceptible to this economical version of the Drown attack. The March 2015 update had refactored the code containing the vulnerability so as to repair a unique flaw (CVE 2015-0293), and so had closed the avenue of attack.

In the latest update, OpenSSL disabled the SSL v2 protocol by default and removed SSL v2 EXPORT ciphers. directors area unit urged to update vulnerable versions of OpenSSL as shortly as attainable.

"Users will avoid this issue by disabling the SSLv2 protocol altogether their SSL/TLS servers, if they've not done thus already," the OpenSSL project team wrote in its security consultive.
Details on the OpenSSL update

According to the OpenSSL consultive, there area unit some caveats for servers running vulnerable versions of OpenSSL. For servers running OpenSSL one.0.1r or 1.0.2f or later, simply disabling all SSLv2 ciphers is adequate. For older versions, disabling the ciphers will not be enough as a result of malicious shoppers will force the server to use SSL v2 victimisation EXPORT ciphers. In those cases, SSL v2 should be disabled likewise.

The latest version of OpenSSL, 1.0.2g and 1.0.1s, disables SSL v2 at build-time by default. To change SSL v2, the builds should be manually organized with "enable-ssl2." though the the build is manually organized with SSL v2, it'll still need to build express calls to form it even tougher to request SSL v2 sessions. The SSLv2 40-bit EXPORT ciphers and SSLv2 56-bit DES are not any longer accessible. Weak ciphers in SSLv3 and up are disabled.

The OpenSSL update additionally self-addressed 5 different low severity vulnerabilities: a double-free bug (CVE 2016-0705) that would result in a denial-of-service attack or memory corruption for applications receiving DSA personal keys from untrusted sources; a memory leak in SRP info operation methodology SRP_VBASE_get_by_user (CVE-2016-0798); a aspect channel attack that produces use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture (CVE 2016-0702); memory problems in BIO_*printf performs (CVE 2016-0799); and a null pointer deref/heap corruption within the BN_hex2bn function (CVE 2016 0797).

The side-channel attack was reportable by an equivalent team of researchers UN agency uncovered Drown. This attack might additionally result in the recovery of RSA keys, however the power to use the attack was "limited because it depends on AN offender UN agency has management of code in a very thread running on an equivalent hyper-threaded core ad the victim threat that is playing decryptions," the consultive aforesaid.

There is an inclination to stay older versions of technology around just-in-case, simply just in case somebody has to use it, simply just in case a method depends on that. The thinking that as long as it isn't utilized by default, (or by browsers) is putt the protection of on-line communications in danger. Drown joins the ranks of the antecedently discovered Logjam and FREAK in showing that even obsolete protocols is abused.

"In the long run we tend to should make sure that all obsolete crypto is sharply off from all systems. If it isn't, it's aiming to return to bite US, sooner or later," Ristic aforesaid.