Updated:  March 14, 2016

Statement Date:   March 10, 2016

Status

Affected

Vendor Statement

"Our version comes with a preferred cipher list which has mitigated SSLv2 issues since march 2015, our latest version 1.9.13.1 was released on 2 march 2016 with Openssl 1.0.2g which has the additional fix(es) for VU#583776."

Vendor Information

ECSystems.nl supports NGINX for Windows

Vendor References

• http://nginx-win.ecsds.eu/

Updated:  March 02, 2016

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

OpenSSL 1.0.2g and 1.0.1s have been released to address this vulnerability. Please see OpenSSL's security advisory at the URL below. A 3rd-party tool http://testssl.sh/ is available to check for security issues, including this one. Another option for network administrators to determine if a server supports SSLv2 is to use the following command: openssl s_client -connect host:443 -ssl2 If certificate information is returned, then SSLv2 is supported. It has been reported that this command may not work on Ubuntu or Debian systems.

Vendor References

• https://www.openssl.org/news/secadv/20160301.txt