I patched up a Postfix + Dovecot server against a DROWN attack (I disabled sslv2 and sslv3).
https://test.drownattack.com
Shows :25
vulnerable to CVE-2016-0703
:110
vulnerable to CVE-2016-0703
...
Afterwards, if I connect with the command line OpenSSL's s_client
using the -ssl2
switch then the protocol is not supported. Can I take this as a misdetection by their scanner?