openssl: cross-protocol attack
| Package(s): | openssl |
CVE #(s): | CVE-2016-0800
|
| Created: | March 1, 2016 |
Updated: | March 2, 2016 |
| Description: |
From the OpenSSL advisory:
A cross-protocol attack was discovered that could lead to decryption of TLS
sessions by using a server supporting SSLv2 and EXPORT cipher suites as a
Bleichenbacher RSA padding oracle. Note that traffic between clients and
non-vulnerable servers can be decrypted provided another server supporting
SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or
POP) shares the RSA keys of the non-vulnerable server. This vulnerability is
known as DROWN. |
| Alerts: |
|
