Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I understand the limitations of SSLv2 and even the limitations of SSLv3 so I'm quite happy to proceed with disabling SSLv2 on our Windows 2008 R2 boxes. My question is that if these servers are not web servers and have no reason for clients to attempt to initiate a HTTPS session is it an exploitable vulnerability? Could an attacker still use a 'roll-back' attack and connect with SSLv2?
SSLv2, enabled on a SSL server, is a potential vulnerability only if all of the following are true:
- There is some client who wants to connect to that server and exchange sensitive data through that SSL tunnel.
- The client agrees to use SSLv2 too.
- The client and server don't implement the version rollback detection system described in RFC 2246, section E.2.
Under all these assumptions, then an attacker may force server and client to use SSLv2 even though both support SSLv3 or more. This in turn may imply some weakness depending on the underlying protocol (the biggest issue with SSLv2 is lack of verified termination, so attackers can force silent truncation, which is a problem if the underlying protocol is not self-terminated).
Given what you say, it is highly improbable that these "SSLv2 support" is a problem in your case.
However, a more interesting question is: what are these servers anyway ? Why would a machine operate a network service, ready to do SSL, if there is no intended client at all ? Why not switching off these unused services ? The issue is not a question of SSLv2 vs SSLv3, but more a question of having network-capable services open for no good reason.