Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Microsoft Takes Steps to Protect IE Users Against POODLE Attacks

Microsoft now allows Internet Explorer 11 users to disable fallback to SSL 3.0 in an effort to protect them against attacks leveraging the recently disclosed vulnerability known as Padding Oracle On Downgraded Legacy Encryption (POODLE).

Microsoft now allows Internet Explorer 11 users to disable fallback to SSL 3.0 in an effort to protect them against attacks leveraging the recently disclosed vulnerability known as Padding Oracle On Downgraded Legacy Encryption (POODLE).

On Tuesday, Microsoft released seven security bulletins which address a total of 24 vulnerabilities in Windows, Internet Explorer, Office, and Exchange. In addition to the security updates, the company has provided Internet Explorer 11 users the option to disable SSL 3.0 fallback for Protected Mode websites, which includes Internet and restricted sites.

The POODLE vulnerability (CVE-2014-3566) can be exploited by an attacker to gain access to communications encrypted with SSL 3.0. Earlier this week, researchers confirmed that the attack also works against some TLS implementations, with numerous websites found to be vulnerable due to the use of load balancers from F5 Networks and A10 Networks.

In late October, Microsoft released a Fix It tool that allows users to disable SSL 3.0 fallback in all supported version of the Web browser. The company has now taken further steps to ensure its customers are protected.

“The December 2014 Internet Explorer Cumulative Update (KB3008923), allows users to opt-in and block SSL 3.0 fallback in Internet Explorer 11. Enterprise customers are able to configure this behavior via Group Policy, and this behavior will also be configurable via registry or using an easy, one-click Fix it solution,” Alec Oot, Internet Explorer program manager, explained in a blog post on Tuesday.

Starting with February 10, 2015, Internet Explorer 11 will prevent insecure fallback to SSL 3.0 for Protected Mode sites by default, Oot said.

Microsoft follows in the footsteps of other browser vendors. In early December, Mozilla disabled the flawed cryptographic protocol completely with the release of Firefox 34. Apple took care of the problem by disabling cipher block chaining (CBC) suites when TLS connection attempts fail.

Google disabled SSL 3.0 fallback in mid-November with the release of Chrome 39. The search engine company plans on disabling the protocol completely in the upcoming Chrome 40.

 

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.