OpenSSL SSLv2 Man-in-the-Middle Vulnerability under Top threats in Daily reports

ghalbedel — Wed, 26 May 2021 13:04:58 GMT

I consistently get OpenSSL SSLv2 Man-in-the-Middle Vulnerability under Top Threats in Daily Reports.

What does this mean? am I getting attacked? is it reporting a vulnerability in devices?

At what level should I be concerned with this?

Re: OpenSSL SSLv2 Man-in-the-Middle Vulnerability under Top threats in Daily reports

reaper — Wed, 26 May 2021 13:20:42 GMT

this is a warning that the SSL traffic passing through might be exploited

from threatvault.paloaltonetworks.com:

OpenSSL is prone to a man-in-the-middle vulnerability while parsing certain crafted SSL requests. The vulnerability is due to the lack of proper checks on SSL requests, leading to an exploitable man-in-the-middle vulnerability. An attacker could exploit the vulnerability by sending crafted SSL requests. A successful attack could lead to remote code execution with the privileges of the server.

if you go into your threat logs, you should be able to pinpoint where these connections are coming from/going to and take appropriate action (patch server, block connection, add exception)

topic Re: OpenSSL SSLv2 Man-in-the-Middle Vulnerability under Top threats in Daily reports in General Topics

OpenSSL SSLv2 Man-in-the-Middle Vulnerability under Top threats in Daily reports

Re: OpenSSL SSLv2 Man-in-the-Middle Vulnerability under Top threats in Daily reports