SSLv2 DROWN attach

DROWN - Decrypting RSA using Obsolete and Weakened eNcryption

The DROWN Attack

DROWN - Cross-protocol attack on TLS using SSLv2 - CVE-2016-0800

［預警］openssl再爆漏洞了，官方建議禁用SSLv2

檢查是否有支援 SSLv2 的方法

How to check if SSL v2 is enabled using openssl

下指令 openssl s_client -connect kokola.maxkit.com.tw:443 -ssl2 ，如果看到 handshake failure 就是沒有 enable SSLv2。

> openssl s_client -connect kokola.maxkit.com.tw:443 -ssl2
CONNECTED(00000003)
140735250387024:error:1407F0E5:SSL routines:ssl2_write:ssl handshake failure:s2_pkt.c:409:

httpd ssl.conf

How to Disable SSLv2 for Apache httpd

如果沒有修改過 httpd ssl.conf 設定，預設是關閉 SSLv2。

#   SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.  Disable SSLv2 access by default:
SSLProtocol all -SSLv2