Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

On IIS, comment patch the SSL 3.0 POODLE vulnerability (CVE-2014-3566)?

ayi

How do I patch <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566" rel="noopener nofollow ugc">CVE-2014-3566</a> on a Windows Server 2012 system running IIS?
Is there a patch in Windows Update, or do I have to do <a href="http://support.microsoft.com/kb/187498" rel="noopener nofollow ugc">a registry change to disable SSL 3.0</a>?
<hr>
Source : <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566" rel="noopener nofollow ugc">Server Fault</a>

ayi_2

There is no “patch”. It’s a vulnerability in the protocol, not a bug in the implementation.
In Windows Server 2003 to 2012 R2 the SSL / TLS protocols are controlled by flags in the registry set at <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols</code>.
To disable SSLv3, which the POODLE vulnerability is concerned with, create a subkey at the above location (if it’s not already present) named <code>SSL 3.0</code> and, under that, a subkey named <code>Server</code> (if it’s not already present). At this location (<code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL 3.0\Server</code>) create a DWORD value named <code>Enabled</code> and leave it set at <code>0</code>.
Disabling SSL 2.0, which you should also be doing, is done the same way, except that you’ll be using a key named <code>SSL 2.0</code> in the above registry path.
I haven’t tested all versions, but I think it’s probably safe to assume that a reboot is necessary for this change to take effect.