New vulnerability at Open SSLv2: Drown Attack

New vulnerability at Open SSLv2: Drown Attack

There is a new Open SSLv vulnerability called “Drown Attack”


Who’s vulnerable:every server using OpenSSLv2 protocol.

About of 2.3 million of HTTPS servers are vulnerable to “Special Drown” attack and 3.5 million of HTTPS servers vulnerable to “General Drown” attack, also the Drown Attack team run an Internet wide scan and they got this results:

  • HTTPS — Top one million domains 25%
  • HTTPS — All browser-trusted sites 22%
  • HTTPS — All sites 33%

How it works:

An attacker can decrypt the communication channel between the client and the server, and get information and files that can compromise the privacy of the clients, the attacker tries to decrypt messages using the SSLv2 protocol, its required have the same private key for SSLv2 and TLS to decrypt all the TLS messages, this attack it’s a variant of the one created by Daniel Bleichenbacher in 1990’s

There’s another variation of this attack named “Special DROWN” that uses another vulnerability of SSLv2 to decrypt the message in one minute using one cpu core, that vulnerability “OpenSSL handles SSLv2 key processing” and was patched in March 2015

How to solve it:

How to solve it: disable OpenSSLv2 protocol on your server and its cipher suites, do not use the same private/public key between protocols.

If you feel that your server can be vulnerable to this new kind of attack you can use to verify the actual state of your ssl configuration and possible vulnerabilities, you can also check if your site was detected as vulnerable to drown attack here


Looking for a professional DevOps team to bring your project to life?


to our newsletter

Table of Contents

We Make
DevOps Easier

From building robust applications to staff augmentation

We provide cost-effective solutions tailored to your needs. Ready to elevate your IT game?

Contact us

Work with us now!

You are all set!
A Sales Representative will contact you within the next couple of hours.
If you have some spare seconds, please answer the following question