Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Jeff Sanders — Tue, 02 Oct 2012 19:38:14 GMT

Hi Dan,

This article should be fairly complete however you can certainly open a support case to discuss this further.

support.microsoft.com/oas

-Jeff

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Dan Martin — Tue, 02 Oct 2012 19:14:47 GMT

It looks like we are bumping into this issue as well.

JPSanders, is there any way that we can discuss this further via PM? My team has several questions regarding the behavior of this patch and how we can work around the issues we are seeing.

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Jeff Sanders — Thu, 04 Nov 2010 11:39:33 GMT

That server is built on open source I believe. The problem would be with the openSSL library. He can build get the openSSL library himself and rebuild the code for the server. He can also request a fix from the vendor. Every client that calls the server could also be patched as an alternative. Obviously patching every client is not a great idea gut it is possible.

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Asher T — Thu, 04 Nov 2010 02:37:53 GMT

I've got a customer who's using webMethods Integration Server and he's facing this issue as well. Does he need to request a patch for webMethods? Also does your workaround need to be done at client side? It's a Win2k3 x86 Server SP3 for the server but client side could be any desktop OS.

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Jeff Sanders — Mon, 04 Oct 2010 16:55:25 GMT

Mike, It should!

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Mike B — Fri, 17 Sep 2010 23:29:35 GMT

Does the UseScsvForTls registry setting work on Windows 2008R2?

re: Understanding Problems with MS10-049, KB 980436 and IETF RFC5746

Alan McF — Sat, 11 Sep 2010 13:20:03 GMT

For those who haven't read the RFC Draft, SCSV stands for "Signalling Cipher Suite Value":

"This SCSV is not a true cipher suite ... instead it has the same semantics as an empty "renegotiation_info" extension, ...

("Because SSLv3 and TLS implementations reliably ignore unknown cipher suites, the SCSV may be safely sent to any server.")