Microsoft Security Advisory: Vulnerability in TLS/SSL could allow spoofing

About this update

Description of this update

This update is not a security update that end-users can install. Instead, this update is recommended for server administrators only. This update deploys a workaround that disables Transport Layer Security (TLS) and Secure Sockets Layer (SSL) renegotiation support on affected systems to help protect clients that connect to such servers from exploitation by using this vulnerability.

TLS renegotiation is a component of the Transport Layer Security protocol and may be required by certain applications. We recommend that customers validate the need for implementing this workaround, and if it is considered required, test this workaround carefully for the applicable deployment scenario or scenarios.

Functionality and purpose of the workaround

This workaround provides system administrators a way to help protect all clients that connect to a server from exploitation by using the vulnerability described in security advisory 977377. The workaround achieves this by disabling TLS/SSL renegotiation. This is the component of the TLS/SSL protocol that is vulnerable to this issue.

This workaround is only effective when it is installed on a server installation. Installation of the workaround will protect all connections initiated by clients to that server. This workaround should never be installed on client computers, because it will not provide any additional security benefit.

Known issues with this update

• After you install this security update, you cannot use the legacy provisioning service parameter (–UseLegacyProvisioningService) when you create a federation trust with the Microsoft Federation Gateway. The security update will prevent the federation trust from working correctly. This problem will occur if you install this security update on a computer that is running Exchange Server 2010 or Exchange Server 2010 Service Pack 1 before you have created a federation trust. To avoid this problem, you must create the federation trust before you install this security update. 
  For more information about how to create a federation trust by using the –UseLegacyProvisioningService parameter, visit the following Microsoft webpage:
  
  
  Create a Federation Trust
• When you install this update on a computer that has the Microsoft Online Single Sign-In services client installed, you may experience the following issues:
  
  
  • The Sign In client cannot obtain user configuration information. This only affects new users who are running the Sign In client for the first time. The Sign In client cannot obtain information to configure Outlook. If the Sign In client has already run and configured the applications, there are no additional issues with the Sign In client.
  • Outlook users cannot see free/busy information. Therefore, this update also affects existing Outlook users.
  To resolve this problem, set the DisableRenegoOnClient registry entry to a value of 0 (zero), and then restart the computer.
  
  
  
  ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
  322756 How to back up and restore the registry in Windows
  
  To configure the DisableRenegoOnClient registry entry, follow these steps:
  
  
  1. Click Start, type regedit in the Start Search box, and then click regedit.exe in the Programs list.
     
     
     
     If you are prompted for an administrator password or confirmation, type your password or click Continue.
  2. Click Start, click Run, type regedit in the Open box, and then click OK.
  3. Locate and then click the following subkey in the registry:
     
     HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL
     
  4. Right-click DisableRenegoOnClient, and then click Modify.
  5. In the Value data box, type 0, and then click OK.
  6. Exit Registry Editor, and then restart the computer.
• This update disables TLS/SSL renegotiation, common protocol functionality that is required for specific applications. This may cause this software to no longer function as expected. If any side effects are experienced, customers should uninstall the workaround to resolve the issue.
  
  The following software has been tested by Microsoft and that has been found to experience problems when you install this update:
  
  
  • Windows 7 DirectAccess: The IP HTTPS interface will not function.
  • Exchange ActiveSync: Does not function when it uses certificate client authentication.
  • Internet Information Services (IIS): In certain configurations, IIS using certificate client authentication, including certificate mapping scenarios, will be affected. Site-wide client certificate authentication will not be affected and will continue to function.
  • Internet Explorer: When you browse Web sites that require client certificate authentication, but not site-wide client certificate authentication, you may not successfully be able to connect.

Configuration

Upon installation, this update will disable client-side and server-side renegotiation. This behavior can be controlled through two registry keys: Notes

• If the DisableRenegoOnClient subkey is present and has any nonzero value:
  
  
  • The client will not initiate renegotiation.
  • The client will not respond to renegotiation.
• If the DisableRenegoOnClient subkey is missing or is present and has a zero value:
  
  
  • The client will initiate renegotiation.
  • The client will respond to renegotiation.
• If the DisableRenegoOnServer subkey is present and has any nonzero value:
  
  
  • Server initiated renegotiation is not allowed.
  • The server will not respond to renegotiation requests from the client.
• If the DisableRenegoOnServer subkey is missing or is present and has a zero value:
  
  
  • Server initiated renegotiation is allowed.
  • The server will respond to renegotiation requests from the client.