Nessus is continuously updated with information about advanced threats and zero-day vulnerabilities, and new types of regulatory compliance configuration audits. Securit圜enter Continuous View (CV) provides continuous network monitoring, vulnerability identification, risk reduction, and compliance monitoring. This dashboard can be easily located in the Securit圜enter Feed under the category Security Industry Trends. This dashboard and its components are available in the Securit圜enter Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. Additionally, filters for DROWN-specific plugins are used to provide information about hosts with confirmed DROWN vulnerabilities. Components monitor the presence of SSLv2 and web service libraries that have SSLv2 enabled by default. Data is filtered to identify systems with SSLv2 enabled using specific plugins, vulnerability text, and CVE IDs. The DROWN Attack Vulnerability dashboard assists security teams with identifying systems on the network that are vulnerable to DROWN attacks. Securit圜enter provides an accurate understanding of the organization’s exposure to DROWN attacks by integrating with Nessus, the Passive Vulnerability Scanner (PVS), and the Log Correlation Engine (LCE). DROWN vulnerability can only be remediated on servers with SSLv2 enabled client software and browsers cannot be hardened against DROWN. Since certificates are commonly reused, a single system with SSLv2 enabled can expose other servers to the same risk. Servers can also be vulnerable if they use a private key that is used by any other server that has SSLv2 enabled. Servers are vulnerable to DROWN if they allow SSLv2 connections, which can be enabled due to misconfiguration or overlooked default settings. Unlike other SSL vulnerabilities, DROWN only requires that SSLv2 be enabled on the attacked system and not that SSLv2 be used for communications.

DROWN is a cross-protocol attack that can decrypt passively collected TLS sessions from up-to-date clients. The attack exploits a flaw in SSLv2 that allows the attacker to decrypt communications that use SSL or TLS. DROWN (Decrypting RSA with Obsolete and Weakened eNcryption) (CVE-2016-0800) is a vulnerability that affects services that rely on SSL and TLS.

How to use nessus drown detection