Microsoft has released a Microsoft security advisory about this issue for IT professionals. The security advisory contains additional security-related information. To view the security advisory, visit the following Microsoft Web site:

About this update

Description of this update

This update is not a security update that end-users can install. Instead, this update is recommended for server administrators only. This update deploys a workaround that disables Transport Layer Security (TLS) and Secure Sockets Layer (SSL) renegotiation support on affected systems to help protect clients that connect to such servers from exploitation by using this vulnerability.

TLS renegotiation is a component of the Transport Layer Security protocol and may be required by certain applications. We recommend that customers validate the need for implementing this workaround, and if it is considered required, test this workaround carefully for the applicable deployment scenario or scenarios.

Functionality and purpose of the workaround

This workaround provides system administrators a way to help protect all clients that connect to a server from exploitation by using the vulnerability described in security advisory 977377. The workaround achieves this by disabling TLS/SSL renegotiation. This is the component of the TLS/SSL protocol that is vulnerable to this issue.

This workaround is only effective when it is installed on a server installation. Installation of the workaround will protect all connections initiated by clients to that server. This workaround should never be installed on client computers, because it will not provide any additional security benefit.

Known issues with this update

• After you install this security update, you cannot use the legacy provisioning service parameter (–UseLegacyProvisioningService) when you create a federation trust with the Microsoft Federation Gateway. The security update will prevent the federation trust from working correctly. This problem will occur if you install this security update on a computer that is running Exchange Server 2010 or Exchange Server 2010 Service Pack 1 before you have created a federation trust. To avoid this problem, you must create the federation trust before you install this security update. 
  For more information about how to create a federation trust by using the –UseLegacyProvisioningService parameter, visit the following Microsoft webpage:
  Create a Federation Trust (http://technet.microsoft.com/en-us/library/dd335198.aspx)
• When you install this update on a computer that has the Microsoft Online Single Sign-In services client installed, you may experience the following issues:
  • The Sign In client cannot obtain user configuration information. This only affects new users who are running the Sign In client for the first time. The Sign In client cannot obtain information to configure Outlook. If the Sign In client has already run and configured the applications, there are no additional issues with the Sign In client.
  • Outlook users cannot see free/busy information. Therefore, this update also affects existing Outlook users.
  To resolve this problem, set the DisableRenegoOnClient registry entry to a value of 0 (zero), and then restart the computer.
  
  Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
  322756  (http://kbalertz.com/Feedback.aspx?kbNumber=322756/ ) How to back up and restore the registry in Windows
  
  To configure the DisableRenegoOnClient registry entry, follow these steps:
  1. Click Start
     Collapse this imageExpand this image

     
     , type regedit in the Start Search box, and then click regedit.exe in the Programs list.
     
     
     Collapse this imageExpand this image

     
     If you are prompted for an administrator password or confirmation, type your password or click Continue.
  2. Click Start, click Run, type regedit in the Open box, and then click OK.
  3. Locate and then click the following subkey in the registry:
     HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL
  4. Right-click DisableRenegoOnClient, and then click Modify.
  5. In the Value data box, type 0, and then click OK.
  6. Exit Registry Editor, and then restart the computer.
• This update disables TLS/SSL renegotiation, common protocol functionality that is required for specific applications. This may cause this software to no longer function as expected. If any side effects are experienced, customers should uninstall the workaround to resolve the issue.
  
  The following software has been tested by Microsoft and that has been found to experience problems when you install this update:
  • Windows 7 DirectAccess: The IP HTTPS interface will not function.
  • Exchange ActiveSync: Does not function when it uses certificate client authentication.
  • Internet Information Services (IIS): In certain configurations, IIS using certificate client authentication, including certificate mapping scenarios, will be affected. Site-wide client certificate authentication will not be affected and will continue to function.
  • Internet Explorer: When you browse Web sites that require client certificate authentication, but not site-wide client certificate authentication, you may not successfully be able to connect.

Configuration

Upon installation, this update will disable client-side and server-side renegotiation. This behavior can be controlled through two registry keys: Notes

• If the DisableRenegoOnClient subkey is present and has any nonzero value:
  • The client will not initiate renegotiation.
  • The client will not respond to renegotiation.
• If the DisableRenegoOnClient subkey is missing or is present and has a zero value:
  • The client will initiate renegotiation.
  • The client will respond to renegotiation.
• If the DisableRenegoOnServer subkey is present and has any nonzero value:
  • Server initiated renegotiation is not allowed.
  • The server will not respond to renegotiation requests from the client.
• If the DisableRenegoOnServer subkey is missing or is present and has a zero value:
  • Server initiated renegotiation is allowed.
  • The server will respond to renegotiation requests from the client.

The following files are available for download from the Microsoft Download Center:

Update for Windows 7

Download the Windows6.1-KB977377-x86 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=0efc0922-63c7-4415-a4fd-612d1b04e570)

Update for Windows 7 for x64-based Systems

Download the Windows6.1-KB977377-x64 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=6569d891-560b-47c5-8e7a-ded76c21a109)

Update for Windows Server 2008 R2 for Itanium-based Systems

Download the Windows6.1-KB977377-ia64 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=32942b1e-be95-46df-9a7f-3fd5e8560af8)

Update for Windows Server 2008 R2 x64 Edition

Download the Windows6.1-KB977377-x64 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=e23edb59-d0e9-4cd8-8ddc-f5e45b2f563a)

Update for Windows Vista

Download the Windows6.0-KB977377-x86 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=d24215ac-a988-4d7d-aae8-eadeca3fe822)

Update for Windows Vista for x64-based Systems

Download the Windows6.0-KB977377-x64 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=137cd547-3cf3-49f6-817d-cf2584921e29)

Update for Windows Server 2008

Download the Windows6.0-KB977377-x86 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=384fe571-fb6b-46ac-8ae4-fc260b89c6b3)

Update for Windows Server 2008 for Itanium-based Systems

Download the Windows6.0-KB977377-ia64 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=04200ec1-8bce-492f-92f9-07eba9fbaae0)

Update for Windows Server 2008 x64 Edition

Download the Windows6.0-KB977377-x64 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=855bcc29-1507-43e6-865d-a3ad8392310e)

Update for Windows Server 2003

Download the WindowsServer2003-KB977377-x86-ENU package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=14d64ad0-312b-4f37-89b8-6731c5886578)

Update for Windows Server 2003 for Itanium-based Systems

Download the WindowsServer2003-KB977377-ia64-ENU package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=e6ce01d8-826b-4844-ae77-8867e4984e0f)

Update for Windows Server 2003 x64 Edition

Download the WindowsServer2003.WindowsXP-KB977377-x64-ENU package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=77013b52-6194-4975-b663-f746e4d6b1cd)

Update for Windows XP x64 Edition

Download the WindowsServer2003.WindowsXP-KB977377-x64-ENU package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=d21ccdef-8b96-41ff-9f13-0cb06002bafc)

Update for Windows XP

Download the WindowsXP-KB977377-x86-ENU package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=6429fd02-8138-4919-9942-80d62ecef22e)

Update for Windows 2000

Download the Windows2000-KB977377-x86-ENU package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=55c20bfb-cbd1-4bbe-92e3-774015ac560b)

Release Date: February 9, 2010

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows 2000 file information

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP and Windows Server 2003 file information

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the "SP requirement" and "Service branch" columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and of Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR
  6.0.6002.18xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	GDR
  6.0.6002.22xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000.xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and Windows Server 2008

For all supported IA-64-based versions of Windows Server 2008

Additional file information for Windows Vista and Windows Server 2008

Additional files for all supported x86-based versions of Windows Vista and Windows Server 2008

Additional files for all supported x64-based versions of Windows Vista and Windows Server 2008

Additional files for all supported IA-64-based versions of Windows Server 2008

Windows 7 and Windows Server 2008 R2 file information

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.1.7600.16xxx	Windows 7 and Windows Server 2008 R2	RTM	GDR
  6.1.7600.20xxx	Windows 7 and Windows Server 2008 R2	RTM	LDR

• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows 7 and Windows Server 2008 R2" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows 7

For all supported x64-based versions of Windows 7 and Windows Server 2008 R2

For all supported IA-64-based versions of Windows Server 2008 R2

Additional file information for Windows 7 and Windows Server 2008 R2

Additional files for all supported x86-based versions of Windows 7

Additional files for all supported x64-based versions of Windows 7 and Windows Server 2008 R2

Additional files for all supported IA-64-based versions of Windows Server 2008 R2