Cipher suites which are potentially vulnerable to BEAST are those which use block ciphers in CBC mode (e.g.
TLS_RSA_WITH_3DES_EDE_CBC_SHA). Moreover, the cipher suite selection system in SSL works like this:
- The client sends the list of cipher suites that it is willing to support.
- The server selects one cipher suite in that list, that it also supports.
The list sent by the client is ordered by preference: the first suite in the list is the one which the client wishes most to use. A courteous server should honour the client's preferences. IIS6 appears to be "courteous" and this cannot be changed.
BEAST is a client attack; when we say that a server is vulnerable to BEAST, we actually mean that the server has the opportunity to protect the client, and yet does not do it. Namely, the "vulnerability" occurs when:
- The protocol version is SSL 3.0 or TLS 1.0 (TLS 1.1+ is inherently immune to BEAST-like exploits).
- The client advertises only cipher suites which uses CBC; or, more often, the client advertises some CBC cipher suites first (in order of preference), with RC4-based suites coming only after, and the server does not enforce use of RC4 (i.e. the server is too courteous).
Since IIS6 cannot be uncourteous, you have to disable the CBC-based cipher suites altogether. See @jimbobmcgee's answer for pointers. This has the side effect of refusing to talk to clients who know only of CBC-based cipher suites, but browsers which cannot do RC4 are extremely rare.