Am 4. März schrieb ich eine Liste von SSL FREAK Attack betroffenen Browser. Laut heise hat Microsoft die Lücke in mehreren Komponenten bestätigt. Neben dem Internet Explorer seien auch Outlook, der Media Player und andere Windows-Anwendungen bedroht, die die HTTP-Kommunikation der Secure-Channel-Komponente nutzen. Ausnahmen bilden die Server-Versionen. Windows Server 2003 sei wiederum betroffen laut Sicherheitswarnung.
Microsoft arbeitet an einem Update, Termin ist aber noch nicht bekannt. Auch WindowsPhone ist betroffen. Seltsamerweise zeigt der Browser aber an, dass er sicher ist.
Bis zur Verteilung kann man sich mit folgendem Workaround helfen:
- At a command prompt, type gpedit.msc and press Enter to start the Group Policy Object Editor.
- Expand Computer Configuration, Administrative Templates, Network, and then click SSL Configuration Settings.
- Under SSL Configuration Settings, click the SSL Cipher Suite Order setting.
- In the SSL Cipher Suite Order pane, scroll to the bottom of the pane.
- Follow the instructions labeled How to modify this setting, and enter the following cipher list:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
- Click OK
- Close the Group Policy Object Editor and then restart your computer.
Um den Workaround rückgängig zu machen:
- At a command prompt, type gpedit.msc and press Enter to start the Group Policy Object Editor.
- Expand Computer Configuration, Administrative Templates, Network, and then click SSL Configuration Settings.
- Under SSL Configuration Settings, click the SSL Cipher Suite Order setting.
- In the SSL Cipher Suite Order pane, click Edit policy setting.
- In the SSL Cipher Suite Order window, select Disabled and then click OK.
- Close the Group Policy Object Editor and then restart your computer.