Microsoft reveals Windows vulnerable to FREAK SSL flaw

Summary:Redmond has said that the FREAK security flaw is found in versions of its Windows operating system from Windows Server 2003, Windows Vista, and higher.

 

By Chris Duckett | March 6, 2015 -- 03:12 GMT (19:12 PST)

 

The FREAK security bug that allows attackers to conduct man-in-the-middle attacks on Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connections encrypted using an outmoded cipher has claimed another victim. This time, it is Microsoft's Secure Channel stack.

"Microsoft is aware of a security feature bypass vulnerability in Secure Channel (Schannel) that affects all supported releases of Microsoft Windows," the company said in a security advisory. "The vulnerability facilitates exploitation of the publicly disclosed FREAK technique, which is an industry-wide issue that is not specific to Windows operating systems."

Although Microsoft Research was part of the team to uncover FREAK alongside European cryptographers, Redmond chose not to reveal Windows as vulnerable until today.

 

"When this security advisory was originally released, Microsoft had not received any information to indicate that this issue had been publicly used to attack customers," the company said.

Microsoft said it is "actively working" with its Microsoft Active Protections Program partners to protect them, and once it has completed an investigation, it would "take the appropriate action to help protect customers".

"This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs," Microsoft said.

Affected versions of Windows include Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 8 and 8.1, Windows Server 2012, and Windows RT.

Microsoft said users could disable the RSA key exchange ciphers that result in FREAK by changing the SSL Cipher Suite in the Group Policy Object Editor -- unless they are using Windows Server 2003, which does not allow for individual ciphers to be enabled and disabled.

"Windows servers are not impacted in the default configuration (export ciphers disabled)," the company said.

After claiming the software stacks that rely on Apple TLS/SSL and OpenSSL earlier in the week, companies have been scrambling to release patches for impacted systems.


At the time of writing, the list of affected web browsers on freakattack.com included Internet Explorer, Chrome on Android, the stock Android browser, Safari on Mac OS X and iOS, BlackBerry browser, and Opera on Mac OS X and Linux.

Users can test whether their web browser is affected at the FREAK Client Test Tool.

Topics: Security, Microsoft, Windows

About Chris Duckett

Chris started his journalistic adventure in 2006 as the Editor of Builder AU after originally joining CBS as a programmer. After a Canadian sojourn, he returned in 2011 as the Editor of TechRepublic Australia, and is now the Australian Editor of ZDNet.