• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 252
  • Last Modified:

how to disable sslv3 for all my computers

how to disable sslv3 for all my computers, do anyone have any ideas?
http://www.saotn.org/time-disable-sslv3-or-what/
0
NxJNY
Asked:
NxJNY
  • 2
  • 2
  • 2
  • +1
2 Solutions
 
John-Charles-HerzbergCommented:
If you need to Disabling POODLE  SSLv3 Support in Browsers this is how you do it.

https://zmap.io/sslv3/browsers.html
0
 
StampelCommented:
SSLv3 need to be disabled on the server side only
0
 
NxJNYAuthor Commented:
Thanks Guys

@ John-Charles-Herzberg - i was hoping for a solution to disable all PC's via script or some other tool rather than doing one PC at a time.

@ Stampel - are you sure if we disable only server side it will not affect the local PC's
0
Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

 
StampelCommented:
Nop It won't, SSL will fallback to SSLv2 (assuming you had SSLv2 Cypher on server side, but who would not ? And you will review this when configuring server.)
0
 
QlemoDeveloperCommented:
At least for IE you can run the MS FixIt or a Group Policy, as described in the MS Security Advisory at https://technet.microsoft.com/en-us/library/security/3009008.aspx . The FixIt can be called with MSI options, I recommend /passive to not get any prompts.

As https://zmap.io/sslv3/browsers.html and other sources tell, you need to change the startup options for Chrome - no setting there. The best automated approach here is the described change of the registry, which can be done with a batch. The batch only acts if Chrome is the default browser.
@echo off
setlocal EnableDelayedExpansion
for /F "tokens=2*" %A in ('reg query HKCR\http\shell\open\command ^| find "Chrome" ') do (
  set val=%%B
  set val=!val:"=""""!
  reg add HKCR\http\shell\open\command /f /ve /t Reg_SZ /d "!val:-- =--ssl-version-min=tls1 -- !"
)

Open in new window


But: Chrome and FireFox will receive updates (if not already done) to disable SSLv3 by default.
And to use an exploit, an attacker needs local, direct access to the victim, and so needs to be in (W)LAN etc.
And of course you need to make sure that the client does not allow SSLv3 to be certain it is not used. You do not have control over all servers, and contacting any unpatched server opens the client up to the attack (if all the other requirements are met, of course). It is not safe to rely on proper server settings.
0
 
QlemoDeveloperCommented:
Any reason for "B" grade? I'm pretty certain my anser was worth more than that.
0
 
NxJNYAuthor Commented:
sorry the B grade was a mistake i meant A - any idea how to change it?
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 2
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now