How to Mitigate DROWN CVE-2016-0800

This blog post will discuss how to Mitigate DROWN CVE-2016-0800.

Unless you’ve been living in a cave you’ll have heard (or likely to hear about soon) the drown attack. From the Red Hat site:

Find out more about CVE-2016-0800 from the MITRE CVE dictionary dictionary and NIST NVD.”

The following graphic should help explain the vulnerability:

In short, disable SSLv2 if you do not need it  (similar to the way SSLv3 was disabled due to POODLE).

So how about those services?

• MySQL uses TLS1.0 for versions < 5.7.10
• MySQL uses a configuration TLS version when using >= 5.7.10

  • tls_version

• MongoDB uses a configuration variable for the TLS for version when using >= 3.0.7

  • net.ssl.disabledProtocols

Please respond in the comments with any questions!