The Netherlands' National Cyber Security Centre publishes a new factsheet advising to Disable SSL 2.0 and upgrade OpenSSL.
On 1 March, a group of researchers presented the DROWN attack methods for TLS. An attacker uses DROWN to abuse servers that still support SSL 2.0. Servers that run a vulnerable version of OpenSSL can be abused in the same way, regardless of whether they support SSL 2.0. An attacker who is able to intercept network traffic that is secured with TLS, may attempt to decrypt this traffic using the vulnerable server. This allows him to inspect the traffic.
The NCSC advises to always configure TLS on the basis of the IT security guidelines for Transport Layer Security. Therefore, disable SSL 2.0, install the most recent updates of OpenSSL and prefer cipher suites that provide forward secrecy on all servers.
This factsheet is aimed at IT administrators, information security professionals and IT managers.
Download the factsheet: NCSC Factsheet
For more information: NCSC Announcement
Contact
For press questions and interviews, please contact: press@enisa.europa.eu.