Microsoft Security Advisory 3046015 (FREAK)

[Corrine]

Microsoft released Security Advisory 3046015 which relates to the SSL/TLS issue referred being referred to as "FREAK" (Factoring attack on RSA-EXPORT Keys).

Most of the publicity surrounding FREAK has been addressing the vulnerability in the Safari, Chrome and Android browsers with OS X, iOS and Android.  However, the flaw also affects many popular websites.  As described in the Security Advisory:

"The vulnerability could allow a man-in-the-middle (MiTM) attacker to force the downgrading of the cipher used in an SSL/TLS connection on a Windows client system to weaker individual ciphers that are disabled but part of a cipher suite that is enabled."

Additional references, including test sites for browser and website vulnerability, are available in my blog post here.