Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Microsoft Takes Steps to Protect IE Users Against POODLE Attacks

Microsoft now allows Internet Explorer 11 users to disable fallback to SSL 3.0 in an effort to protect them against attacks leveraging the recently disclosed vulnerability known as Padding Oracle On Downgraded Legacy Encryption (POODLE).

Microsoft now allows Internet Explorer 11 users to disable fallback to SSL 3.0 in an effort to protect them against attacks leveraging the recently disclosed vulnerability known as Padding Oracle On Downgraded Legacy Encryption (POODLE).

On Tuesday, Microsoft released seven security bulletins which address a total of 24 vulnerabilities in Windows, Internet Explorer, Office, and Exchange. In addition to the security updates, the company has provided Internet Explorer 11 users the option to disable SSL 3.0 fallback for Protected Mode websites, which includes Internet and restricted sites.

The POODLE vulnerability (CVE-2014-3566) can be exploited by an attacker to gain access to communications encrypted with SSL 3.0. Earlier this week, researchers confirmed that the attack also works against some TLS implementations, with numerous websites found to be vulnerable due to the use of load balancers from F5 Networks and A10 Networks.

In late October, Microsoft released a Fix It tool that allows users to disable SSL 3.0 fallback in all supported version of the Web browser. The company has now taken further steps to ensure its customers are protected.

“The December 2014 Internet Explorer Cumulative Update (KB3008923), allows users to opt-in and block SSL 3.0 fallback in Internet Explorer 11. Enterprise customers are able to configure this behavior via Group Policy, and this behavior will also be configurable via registry or using an easy, one-click Fix it solution,” Alec Oot, Internet Explorer program manager, explained in a blog post on Tuesday.

Starting with February 10, 2015, Internet Explorer 11 will prevent insecure fallback to SSL 3.0 for Protected Mode sites by default, Oot said.

Microsoft follows in the footsteps of other browser vendors. In early December, Mozilla disabled the flawed cryptographic protocol completely with the release of Firefox 34. Apple took care of the problem by disabling cipher block chaining (CBC) suites when TLS connection attempts fail.

Google disabled SSL 3.0 fallback in mid-November with the release of Chrome 39. The search engine company plans on disabling the protocol completely in the upcoming Chrome 40.

Advertisement. Scroll to continue reading.

 

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.