CVE-2014-3566 關閉sslv3 in windows

https://technet.microsoft.com/en-us/library/security/3009008.aspx

Suggested Actions

Apply Workarounds

Workarounds refer to a setting or configuration change that does not correct the underlying issue but would help block known attack vectors before a security update is available.

• Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 in Internet Explorer
  You can disable the SSL 3.0 protocol in Internet Explorer by modifying the Advanced Security settings in Internet Explorer.
  To change the default protocol version to be used for HTTPS requests, perform the following steps:
  1. On the Internet Explorer Tools menu, click Internet Options.
  2. In the Internet Options dialog box, click the Advanced tab.
  3. In the Security category, uncheck Use SSL 3.0 and check Use TLS 1.0, Use TLS 1.1, and Use TLS 1.2 (if available).
  4. Click OK.
  5. Exit and restart Internet Explorer.
  
  
  Note  After applying this workaround, Internet Explorer will fail to connect to Web servers that only support SSL up to 3.0 and don’t support TLS 1.0, TLS 1.1, and TLS 1.2. 

• Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 for Internet Explorer in Group Policy
  You can disable support for the SSL 3.0 protocol in Internet Explorer via Group Policy by modifying the Turn Off Encryption Support Group Policy Object.
  1. Open Group Policy Management.
  2. Select the group policy object to modify, right click and select Edit.
  3. In the Group Policy Management Editor, browse to the following setting:
     Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Turn off encryption support
  4. Double-click the Turn off Encryption Support setting to edit the setting.
  5. Click Enabled.
  6. In the Options window, change the Secure Protocol combinations setting to "Use TLS 1.0, TLS 1.1, and TLS 1.2".
  7. Click OK.
  
  
  Note Administrators should make sure this group policy is applied appropriately by linking the GPO to the appropriate OU in their environment.
  
  
  Note After applying this workaround, Internet Explorer will fail to connect to Web servers that only support SSL up to 3.0 and don’t support TLS 1.0, TLS 1.1, and TLS 1.2. 

• Disable SSL 3.0 in Windows
  You can disable support for the SSL 3.0 protocol on Windows by following these steps:
  1. Click Start, click Run, type regedt32 or type regedit, and then click OK.
  2. In Registry Editor, locate the following registry key:
     HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders \SCHANNEL\Protocols\SSL 3.0\Server
     Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
  3. On the Edit menu, click Add Value.
  4. In the Data Type list, click DWORD.
  5. In the Value Name box, type Enabled, and then click OK. 
     Note If this value is present, double-click the value to edit its current value.
  6. Type 00000000 in Binary Editor to set the value of the new key equal to "0".
  7. Click OK. Restart the computer.
  
  
  Note This workaround will disable SSL 3.0 for all server software installed on a system, including IIS.
  
  
  Note After applying this workaround, clients that rely only on SSL 3.0 will not be able to communicate with the server.

掃描SSLV3漏洞(預防POODLE Attack)

因為這次的漏洞是在SSLV3的協定上，沒辦法靠Patch進行修正，需要關閉sslv3，開啟tls

使用nmap+ssl-enum-ciphers掃描
下載NMAP：http://nmap.org/download.html
下載ssl-enum-ciphers.nse，http://nmap.org/svn/scripts/ssl-enum-ciphers.nse

說明頁：http://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html

使用方式：
網址：https://www.vanstechelman.eu/content/scan-for-poodle-using-nmap-from-a-windows-machine

語法範例：
nmap --script ssl-enum-ciphers -p 443 192.168.1.17
nmap --script ssl-enum-ciphers -p 443 192.168.1.0/24

有使用sslv3的話會出現這樣
Starting Nmap 6.40 ( http://nmap.org ) at 2014-10-15 12:27 Romance Daylight Time

Nmap scan report for 192.168.1.17
Host is up (0.019s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_RC4_128_SHA - strong
|     compressors:
|       NULL
|   TLSv1.0:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_RC4_128_SHA - strong
|     compressors:
|       NULL
|_  least strength: strong

Nmap done: 1 IP address (1 host up) scanned in 22.44 seconds

沒使用sslv3
nmap --script ssl-enum-ciphers -p 443 192.168.1.17

Starting Nmap 6.40 ( http://nmap.org ) at 2014-10-15 12:33 Romance Daylight Time

Nmap scan report for 192.168.1.17
Host is up (0.019s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   SSLv3: No supported ciphers found
|   TLSv1.0:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_RC4_128_SHA - strong
|     compressors:
|       NULL
|_  least strength: strong

Nmap done: 1 IP address (1 host up) scanned in 21.74 seconds