DROWN, a new vulnerability in OpenSSL that affects servers using SSLv2, was revealed today as an attack that could decrypt your secure HTTPS communications, such as passwords or credit card numbers. More than 33 percent of servers are vulnerable — significantly less than Heartbleed, but still a surprisingly high number.
To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. This includes web servers, SMTP servers, IMAP and POP servers, and any other software that supports SSL/TLS. You can use the form above to check whether your server appears to be exposed to the attack.
1.DROWN的定义和解释：
DROWN stands for Decrypting RSA with Obsolete and Weakened eNcryption.
DROWN是一种SSL/TLS新型的攻击方式（Bleichenbacher padding oracle attack），全称是破解使用弱RSA加密漏洞。
Do I need to get a new certificate for my server?
Probably not. As the attacker does not learn the server’s private key, there’s no need to obtain new certificates. The only action required is disabling SSLv2 as per the countermeasures explained above. If you cannot confidently determine that SSLv2 is disabled on every device or server that uses your server’s private key, you should generate a fresh key for the server and obtain a new certificate.
这个漏洞目前来看不会因此泄露加密、解密过程中用到的“私钥”，所以目前的解决方案就是禁用SSLv2。
In technical terms, DROWN is a new form of cross-protocol Bleichenbacher padding oracle attack. It allows an attacker to decrypt intercepted TLS connections by making specially crafted connections to an SSLv2 server that uses the same private key.
How easy is it to carry out the attack? Is it practical?
Yes. We’ve been able to execute the attack against OpenSSL versions that are vulnerable to CVE-2016-0703 in under a minute using a single PC. Even for servers that don’t have these particular bugs, the general variant of the attack, which works against any SSLv2 server, can be conducted in under 8 hours at a total cost of $440.
3.MitM
Can DROWN be also used to perform MitM attacks?
Yes. Some variants of the attack can be used to perform MitM attacks against TLS or QUIC.