What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update?
From [Dailydave] More info on SSLMAGEDON:
Our friends at BeyondTrust have a page on the bug now:
One thing I think people are missing is that this bug works by default
on Windows 7 and above. You can force a client cert down Window's
throat, which triggers the vulnerability regardless of configuration
From Assessing Risk for the November 2014 Security Updates:
"Most likely attack vector" [...for MS14-066 is...] "User browses to a malicious webpage."
Note: "User browses to a malicious webpage" was changed to "A malicious user sends specially crafted packets to an exposed service" after I wrote the previous sentence.
Does this only apply to IE, or do the other browsers use the vulnerable library as well?
From the document at TLS/SSL hardening and compatibility Report 2011:
In order to assess the SSL/TLS support of modern Internet browsers we had to take a look at the SSL engines they use. Some SSL stacks generally have capabilities that browsers do not make use of per default, the lists below only reflect real default browser usage.
Chrome and Firefox use the NSS engine
IE5, 6, 7, 8 and Safari use Microsoft SCHANNEL
Opera and Safari (OSX) use custom SSL engines
From Transport Layer Security:
TLS support of Opera 14 and above is same as that of Chrome, because Opera has migrated to Chromium backend