Microsoft now allows Internet Explorer 11 users to disable fallback to SSL 3.0 in an effort to protect them against attacks leveraging the recently disclosed vulnerability known as Padding Oracle On Downgraded Legacy Encryption (POODLE).
On Tuesday, Microsoft released seven security bulletins which address a total of 24 vulnerabilities in Windows, Internet Explorer, Office, and Exchange. In addition to the security updates, the company has provided Internet Explorer 11 users the option to disable SSL 3.0 fallback for Protected Mode websites, which includes Internet and restricted sites.
The POODLE vulnerability (CVE-2014-3566) can be exploited by an attacker to gain access to communications encrypted with SSL 3.0. Earlier this week, researchers confirmed that the attack also works against some TLS implementations, with numerous websites found to be vulnerable due to the use of load balancers from F5 Networks and A10 Networks.
In late October, Microsoft released a Fix It tool that allows users to disable SSL 3.0 fallback in all supported version of the Web browser. The company has now taken further steps to ensure its customers are protected.
“The December 2014 Internet Explorer Cumulative Update (KB3008923), allows users to opt-in and block SSL 3.0 fallback in Internet Explorer 11. Enterprise customers are able to configure this behavior via Group Policy, and this behavior will also be configurable via registry or using an easy, one-click Fix it solution,” Alec Oot, Internet Explorer program manager, explained in a blog post on Tuesday.
Starting with February 10, 2015, Internet Explorer 11 will prevent insecure fallback to SSL 3.0 for Protected Mode sites by default, Oot said.
Microsoft follows in the footsteps of other browser vendors. In early December, Mozilla disabled the flawed cryptographic protocol completely with the release of Firefox 34. Apple took care of the problem by disabling cipher block chaining (CBC) suites when TLS connection attempts fail.
Google disabled SSL 3.0 fallback in mid-November with the release of Chrome 39. The search engine company plans on disabling the protocol completely in the upcoming Chrome 40.
