This question cannot be really answered without knowing what is the involved client software. The client decides what goes into the
ClientHello. Some (most) Web browsers can be configured to use or not-use any specific version of SSL/TLS. For instance, with Firefox, you can use the
about:config URL to access the internal configuration options, in particular
However, we can still stay that such an alteration cannot be forced from the outside (e.g. some firewall or proxy) because the handshake ends with control messages (called "
Finished") whose contents are verified by the peer (the server verifies the contents of the
Finished from the client, and vice versa); the contents are actually a hash value computed over the complete contents of all the previous handshake messages. This ensures that the client and server really saw the same messages, down to the last bit. If you alter a
ClientHello in transit, then the
Finished messages at the end of the connection will not match, and the handshake will not succeed.
(The generic term for forcing a SSL client and server to use a lower version than what they would both like is a version rollback attack; SSL/TLS includes effective protections against that, specifically the contents of the