[bestbits] SSLv2 DROWN Attack

[Wisdom Donkor]

Dear All,

Network traffic encrypted using an RSA-based SSL certificate may be
decrypted if enough SSLv2 handshake data can be collected. Exploitation of
this vulnerability - referred to as DROWN in public reporting - may allow a
remote attacker to obtain the private key of a server supporting SSLv2.
CERT-GH encourages users and administrators to review the attached advisory
for additional information and mitigation details.

Find attached advisory

Kind Regards

CERT-GH
Operations
6th Floor,Ghana House,High Street
PMB, Ministries Post Office
Accra,Ghana
www.cert-gh.org
-----BEGIN PGP SIGNATURE-----
Version: BCPG v1.47

iGIEARECACIFAlYOq58bHENFUlQtR0ggPHRlYW1AY2VydC1naC5vcmc+AAoJEPSE
nVZ6ksPd5ZwAoKDSDLMJwdGtW63kUA7GbxvIn5nfAJwOoLHaf3fZB2ZOKu2rwMLo
PD99EA==
=/LMu
-----END PGP SIGNATURE-----
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.igcaucus.org/pipermail/bestbits/attachments/20160302/93e4347a/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: SSLv2 DROWN Attack_CERT-GH-ADV10102032016.docx
Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document
Size: 610812 bytes
Desc: not available
URL: <http://lists.igcaucus.org/pipermail/bestbits/attachments/20160302/93e4347a/attachment.docx>