MS16-065: Description of the TLS/SSL protocol information disclosure vulnerability (CVE-2016-0149): May 10, 2016

Option 1: Switch to the TLS 1.2 protocol

This option makes the application use the TLS 1.2 protocol by either modifying the registry or programmatically configuring the protocol version.

• Modify the registry
  
  Important
  Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.
  
  The .NET Framework 4.0 and the .NET Framework 4.5.x applications that are running on the .NET Framework 4.5 and later versions can switch the default protocol to TLS 1.2, TLS 1.1, and TLS 1.0 by enabling the SchUseStrongCrypto registry key. This registry key is discussed in the Suggested Actions section of the Microsoft Security Advisory 2960358 topic on the Microsoft TechNet website.
  
  Important This registry change will only work if the following conditions are true:

  • Applications that use ServicePointManager-based APIs are not setting the ServicePointManager.SecurityProtocol value explicitly. Examples of such classes include System.Net.Http.HttpClient, System.Net.FtpWebRequest, System.Net.HttpWebRequest, and System.Net.Mail.SmtpClient. Setting the ServicePointManager.SecurityProtocol in code takes precedence over the registry.

  • Applications are using the SslStream AuthenticateAsClient(String) overload.

  
  

• Programmatically configure the protocol version
  
  The .NET Framework 4.0 and 4.5 applications that are running on the .NET Framework 4.5 and later versions and that use the SslStream AuthenticateAsClient(String, X509CertificateCollection, SslProtocols, Boolean) overload must be recompiled, specifying SslProtocols.Tls12, SslProtocols.Tls11, and SslProtocols.Tls as the third parameter. For a complete description of how to use the SslStream class, see the SslStream Class topic on the Microsoft Developer (MSDN) website.
  
  Note The .NET Framework 4.6 and later versions use TLS 1.2, TLS 1.1, and TLS 1.0 as the protocol defaults. This is discussed in the Microsoft Security Advisory 2960358 topic on the Microsoft TechNet website.

Option 2: Handle split packets

This update causes a single record to be split into multiple records. Therefore, if an application is expecting the complete record to be available in a single Read call, such applications may break. To make sure that the application behaves correctly, verify that the application handles split packets by performing the Stream.Read call correctly. You can use the sample code available here as a reference for how to fix the application to correctly perform the Read call.

For a sample HTTP request that shows the difference in behavior before (with the mitigation) and after (without the mitigation) updates 3147461 and 3147458 were installed, see the "More Information" section.

For a complete example of the Stream.Read method, see the Stream.Read Method (Byte[], Int32, Int32) topic on the Microsoft Developer (MSDN) website.

Method 1: Update registry keys (available for all versions of the .NET Framework)

Disable the SCH_SEND_AUX_RECORD structure (globally)

Disable SCH_SEND_AUX_RECORD structure for individual applications

Method 2: Change configuration at the application level (available only for the .NET Framework version 4.6 and later versions)

Starting with the .NET Framework 4.6, you can change the configuration at an application level through code or application configuration or registry changes.

In the .NET Framework 4.6, you can set the switch by using any of the following methods. These examples disable the security feature.

• Programmatically
  
  The first thing that the application should do is run the following code. This is because Service Point Manager will initialize only one time.
  

  private const string DisableCachingName = @"TestSwitch.LocalAppContext.DisableCaching"; 
  private const string DontEnableSchSendAuxRecordName = @"Switch.System.Net.DontEnableSchSendAuxRecord"; 
  AppContext.SetSwitch(DisableCachingName, true); 
  AppContext.SetSwitch(DontEnableSchSendAuxRecordName , true);

• Application configuration
  
  To change the application configuration, add the following entry:
  

  <runtime>
  <AppContextSwitchOverrides value="Switch.System.Net.DontEnableSchSendAuxRecord=true"/>
  </runtime>

• Registry key (computer global)
  
  

  Registry locations:HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\AppContextHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\AppContext
  Value: Switch.System.Net.DontEnableSchSendAuxRecord
  Type: String
  Value: True
  
  Note Switch.System.Net.DontEnableSchSendAuxRecord = False for all applications.