Issue References

For more information about this issue, see the following references:

This advisory discusses the following software.

Affected Software

What is the scope of the advisory?
The purpose of this advisory is to notify customers that Microsoft is aware of detailed information describing a new method to exploit a vulnerability affecting SSL 3.0. This vulnerability is an information disclosure vulnerability.

How could an attacker exploit the vulnerability?
In a man-in-the-middle (MiTM) attack, an attacker could downgrade an encrypted TLS session forcing clients to use SSL 3.0 and then force the browser to execute malicious code. This code sends several requests to a target HTTPS website, where cookies are sent automatically if a previous authenticated session exists. This is a required condition in order to exploit this vulnerability. The attacker could then intercept this HTTPS traffic, and by exploiting a weakness in the CBC block cypher in SSL 3.0, could decrypt portions of the encrypted traffic (e.g. authentication cookies).

What might an attacker use this vulnerability to do?
An attacker who successfully exploited this vulnerability could decrypt portions of the encrypted traffic.

What causes the vulnerability?
The vulnerability is caused by a weakness in the CBC encryption algorithm used in SSL 3.0.

What is SSL?
Secure Sockets Layer (SSL) is a cryptographic protocol that provides communication security over the Internet. SSL encrypts the data transported over the network, using cryptography for privacy and a keyed message authentication code for message reliability.

What is TLS?
Transport Layer Security (TLS) is a standard protocol that is used to provide secure web communications on the Internet or on intranets. It enables clients to authenticate servers or, optionally, servers to authenticate clients. It also provides a secure channel by encrypting communications. TLS is the latest version of the Secure Sockets Layer (SSL) protocol.

Is TLS affected by this issue?
No. This issue is specific to SSL 3.0.

Is this an industry-wide issue?
Yes. The vulnerability resides in the design of the SSL 3.0 protocol and is not limited to Microsofts implementation.

Apply Workarounds

Workarounds refer to a setting or configuration change that does not correct the underlying issue but would help block known attack vectors before a security update is available.

• Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 in Group Policy

  You can disable the SSL 3.0 protocol that is affected by this vulnerability. You can do this by modifying the Turn Off Encryption Support Group Policy Object.

  1. Open Group Policy Management.
  2. Select the group policy object to modify, right click and select Edit.
  3. In the Group Policy Management Editor, browse to the following setting:

     Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Explorer Control Panel -> Advanced Page -> Turn Off Encryption Support

  4. Double-click the Turn off Encryption Support setting to edit the setting.
  5. Click Enabled.
  6. In the Options window, change the Secure Protocol combinations setting to "Use TLS 1.0, TLS 1.1, and TLS 1.2".
  7. Click OK.

Note:
Note Administrators should make sure this group policy is applied appropriately by linking the GPO to the appropriate OU in their environment.

Note:
Warning After applying this workaround, Internet Explorer will fail to connect to Web servers that only support SSL up to 3.0 and dont support TLS 1.0, TLS 1.1, and TLS 1.2.

• Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 in Internet Explorer

  You can disable the SSL 3.0 protocol that is affected by this vulnerability. You can do this by modifying the Advanced Security settings in Internet Explorer.

  To change the default protocol version to be used for HTTPS requests, perform the following steps:

  1. On the Internet Explorer Tools menu, click Internet Options.
  2. In the Internet Options dialog box, click the Advanced tab.
  3. In the Security category, uncheck Use SSL 3.0 and check Use TLS 1.0, Use TLS 1.1, and Use TLS 1.2 (if available).
  4. Click OK.
  5. Exit and restart Internet Explorer.
     

Note:
Warning After applying this workaround, Internet Explorer will fail to connect to Web servers that only support SSL up to 3.0 and dont support TLS 1.0, TLS 1.1, and TLS 1.2.

Additional Suggested Actions

• Protect your PC

  We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates and installing antivirus software. For more information, see Microsoft Safety & Security Center.

• Keep Microsoft Software Updated

  Users running Microsoft software should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit Microsoft Update, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have automatic updating enabled and configured to provide updates for Microsoft products, the updates are delivered to you when they are released, but you should verify that they are installed.

Microsoft thanks the following for working with us to help protect customers:

• Bodo Mller of the Google Security Team for working with us on this issue

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Feedback

• You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Support

• Customers in the United States and Canada can receive technical support from Security Support. For more information, see Microsoft Help and Support.
• International customers can receive support from their local Microsoft subsidiaries. For more information, see International Support.
• Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

• V1.0 (October 14, 2014): Advisory published.