ÇÔ¸Õ¡ÒáÓ˹´¤èÒ RPC ¨Ðãªé¾ÍÃìµ·Õèá¹è¹Í¹áÅÐÇÔ¸Õ¡Ò÷ÕèªèÇÂÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀѾÍÃìµàËÅèÒ¹Ñé¹ â´Âãªé IPsec

ÁÕ¡ÒõÑ駤èҤ͹¿Ô¡§Ò¹ËÅÒ·Õèµéͧà»ç¹àÊÃç¨ÊÔ鹡ÒÃÂéÒ Ŵ áÅШӡѴ¡ÒÃà¢éÒ¶Ö§¾ÍÃìµ RPC

áá ªèǧ¾ÍÃìµáººä´¹ÒÁÔ¡¢Í§ RPC ¤Çèж١¨Ó¡Ñ´ä»Âѧªèǧ¾ÍÃìµ·ÕèÁÕ¢¹Ò´àÅç¡ manageable ÁÒ¡¡ÇèÒ·Õè¨ÐºÅçÍ¡ä´é§èÒ¢Öé¹ â´Âãªéä¿ÃìÇÍÅÅìËÃ×͹âºÒ IPsec ¨Ñ´µÒÁ¤èÒàÃÔèÁµé¹ RPC Ẻ䴹ÒÁÔ¡ÊÃþÍÃìµã¹ªèǧ¢Í§ 1024 à¾×èÍ 5000 ÊÓËÃѺ»ÅÒ·ҧ·ÕèäÁèä´éÃкؾÍÃìµ·Õè¨Ð¿Ñ§

ËÁÒÂà˵Ø:º·¤ÇÒÁ¹Õéãªéªèǧ¾ÍÃìµ 5021 5001 à¾×èÍËÅÕ¡àÅÕ觡Òà exhausting ephemeral ¾ÍÃìµ áÅÐ à¾×èÍÅ´¨Ó¹Ç¹¾ÍÃìµµèÒ§ æ ·Õè¾ÃéÍÁãªé§Ò¹ä»Âѧ»ÅÒ·ҧ¢Í§ RPC ¨Ò¡ 3,976 ¶Ö§ 20

¢Ñ鹵͹¶Ñ´ä» µéͧÊÃéÒ§¹âºÒ IPsec ·Õèà¾×èͨӡѴ¡ÒÃà¢éÒ¶Ö§ªèǧ¾ÍÃìµ¹Õéà¾×èÍ»¯Ôàʸ¡ÒÃà¢éÒ¶Ö§âÎʵì·Ñé§ËÁ´º¹à¤Ã×Í¢èÒÂ

áÅÐÊØ´·éÒ ¹âºÒ IPsec ·ÕèÊÒÁÒö»ÃѺ»Ãا¡ÒáÓ˹´¤èÒ·Õèá¹è¹Í¹ ip áÍ´à´Ãʢͧ¤Ø³ ËÃ×Íà¤Ã×Í¢èÒÂÂèÍ¢ͧà¤Ã×Í¢èÒÂà¢éÒ ¡Ñº¾ÍÃìµ RPC ¶Ù¡ºÅçͤ áÅÐá¡Í×è¹ æ ·Ñé§ËÁ´

àÁ×è͵éͧ¡ÒÃàÃÔèÁ§Ò¹¢Í§ reconfiguring ªèǧ¾ÍÃìµáººä´¹ÒÁÔ¡ RPC ´ÒǹìâËÅ´à¤Ã×èͧÁ×Í¡ÒõÑ駤èҤ͹¿Ô¡ RPC (RPCCfg.exe), áÅéÇ ¤Ñ´ÅÍ¡ä» ÂѧàÇÔÃì¡Ê൪ѹ ËÃ×Íà«ÔÃì¿àÇÍÃì·Õè¨Ð¶Ù¡ reconfigured â´Â¡ÒÃä»·ÕèàÇçºä«µìµèÍ仹Õé¢Í§ Microsoft::àÁ×è͵éͧ¡Ò÷ӧҹã¹ÀÒÂËÅѧ¡ÒÃÊÃéÒ§¡ÒÃà¾ÔèÁ¹âºÒ IPsec ´ÒǹìâËÅ´à¤Ã×èͧÍÔ¹à·ÍÃìà¹çµâ¾Ãâ·¤ÍÅ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀѹâºÒÂÁ×Í (Ipsecpol.exe), áÅéÇ ¤Ñ´ÅÍ¡ä» ÂѧàÇÔÃì¡Ê൪ѹ ËÃ×Íà«ÔÃì¿àÇÍÃì·Õè¨Ð¶Ù¡ reconfigured â´Â¡ÒÃä»·ÕèàÇçºä«µìµèÍ仹Õé¢Í§ Microsoft::ËÁÒÂà˵Ø:àÁ×è͵éͧ¡ÒÃÊÃéÒ§¹âºÒ IPsec ·Õè ÊÓËÃѺ Microsoft Windows XP ËÃ×ÍÃкº»¯ÔºÑµÔ¡Òà Windows ÃØè¹·ÕèãËÁè¡ÇèÒ ãªé Ipseccmd.exe Ipseccmd.exe à»ç¹Êèǹ˹Ö觢ͧà¤Ã×èͧÁ×ÍʹѺʹع¢Í§ Windows XP äÇÂҡóìáÅСÒÃãªé IPseccmd.exe à»ç¹àËÁ×͹äÇÂҡóìáÅСÒÃãªé Ipsecpol.exeÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺà¤Ã×èͧÁ×ÍʹѺʹع¢Í§ Windows XP ¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft:

ÂéÒ áÅÐÅ´ªèǧ¾ÍÃìµáººä´¹ÒÁÔ¡¢Í§ RPC ä´é â´Âãªé RPCCfg.exe

àÁ×è͵éͧ¡ÒÃÂéÒ áÅÐÅ´ªèǧ¾ÍÃìµáººä´¹ÒÁÔ¡ RPC â´Âãªé RPCCfg.exe ´Óà¹Ô¹¡ÒôѧµèÍ仹Õé:

1. ¡ÒäѴÅÍ¡ RPCCfg.exe ä»Âѧà«ÔÃì¿àÇÍÃì·Õè¨Ð¶Ù¡¡Ó˹´¤èÒ
2. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:rpccfg.exe - pe 5001 - 5021 -Ç 0.
   ËÁÒÂà˵Ø:á¹Ð¹Óªèǧ¾ÍÃìµ¹ÕéãËéãªé â´Â»ÅÒ·ҧ¢Í§ RPC ä´éà¹×èͧ¨Ò¡¾ÍÃìµã¹ªèǧ¹ÕéäÁè¹èÒ¨ÐÊÒÁÒö¨Ñ´ÊÃÃÊÓËÃѺãªé â´Ââ»Ãá¡ÃÁ»ÃÐÂØ¡µìÍ×è¹ â´Â¤èÒàÃÔèÁµé¹ RPC ãªéªèǧ¾ÍÃìµ 1024 à¾×èÍ 5000 ÊÓËÃѺ¡ÒûѹÊèǹ¾ÍÃìµÊÓËÃѺ»ÅÒ·ҧ ÍÂèÒ§äáçµÒÁ ¾ÍÃìµã¹ªèǧ¹Õé»Ñ¹ÂѧẺ䴹ÒÁÔ¡ÊèǹÊÓËÃѺãªé â´ÂÃкº»¯ÔºÑµÔ¡Òà Windows ÊÓËÃѺ Windows ·Ñé§ËÁ´â»Ãá¡ÃÁ»ÃÐÂØ¡µì¢Í§«çÍ¡à¡çµ áÅзÓãËéËÁ´º¹à«ÔÃì¿àÇÍÃì·Õèãªé heavily àªè¹à·ÍÃìÁÔ¹ÍÅà«ÔÃì¿àÇÍÃìáÅÐà«ÔÃì¿àÇÍÃìÃдѺ¡ÅÒ§«Ö觷ÓãËéÊÒÂâ·ÃÍÍ¡ÁÒ¡¡ÑºÃкºÃÐÂÐä¡Å
   
   µÑÇÍÂèÒ§àªè¹ àÁ×èÍ Internet Explorer µÔ´àÇçºà«ÔÃì¿àÇÍÃ캹¾ÍÃìµ 80 ¨ÐÃͺ¹¾ÍÃìµã¹ªèǧ 1024 5000 ¡Òõͺʹͧ¨Ò¡à«ÔÃì¿àÇÍÃì A middle-tier COM server that makes outgoing calls to other remote servers also uses a port in this range for the incoming reply to that call. Moving the range of ports that RPC uses for its endpoints to the 5001 port range will reduce the chance that these ports will be used by other applications.
   For more information about ephemeral port usage in Windows operating systems, visit the following Microsoft Web sites.
   • ÊÓËÃѺ Windows 2000::
     http://technet.microsoft.com/library/bb726981.aspx

     (http://technet.microsoft.com/library/bb726981.aspx)
   • For Windows Server 2003:
     http://technet2.microsoft.com/WindowsServer/en/library/823ca085-8b46-4870-a83e-8032637a87c81033.mspx?mfr=true

     (http://technet2.microsoft.com/WindowsServer/en/library/823ca085-8b46-4870-a83e-8032637a87c81033.mspx?mfr=true)

Use an IPsec or firewall policy to block access to the vulnerable ports on the affected host

In the commands in the following section, any text that appears between percent (%) signs is intended to represent text in the command that must be entered by the person who creates the IPsec policy. For example, wherever the text "%IPSECTOOL%" appears, the person who creates the policy should substitute that text as follows:

• For Windows 2000, substitute "%IPSECTOOL%" with "ipsecpol.exe."
• For Windows XP or a later version of Windows, substitute "%IPSECTOOL%" with "ipseccmd.exe."

For more information about how to use IPsec to block ports, click the following article number to view the article in the Microsoft Knowledge Base:

Block access to the RPC Endpoint Mapper for all IP addresses

To block access to the RPC Endpoint Mapper for all IP addresses, use the following syntax.

ËÁÒÂà˵Ø:On Windows XP and on later operating systems, use Ipseccmd.exe. On Windows 2000, use Ipsecpol.exe (Windows 2000).ËÁÒÂà˵Ø:Do not type "%IPSECTOOL%" in this command. "%IPSECTOOL%" is intended to represent the part of the command that must be customized. For example, on Windows 2000, type the following command from a directory that contains Ipsecpol.exe to block all incoming access to TCP 135:On Windows XP and on later operating systems, type the following command from a directory that contains Ipseccmd.exe to block all incoming access to TCP 135:

Block access to the RPC dynamic port range for all IP addresses

To block access to the RPC dynamic port range for all IP addresses, use the following syntax.

ËÁÒÂà˵Ø:On Windows XP and on later operating systems, use Ipseccmd.exe. On Windows 2000, use Ipsecpol.exe (Windows 2000).ËÁÒÂà˵Ø:Do not type "%IPSECTOOL%" or "%PORT%" in this command. "%IPSECTOOL%" and "%PORT%" are intended to represent parts of the command that must be customized. For example, type the following command on Windows 2000 hosts to block all incoming access to TCP 5001:To block all incoming access to TCP 5001, type the following command on Windows XP hosts and on hosts of later Windows operating systems:Repeat this command for each RPC port that must be blocked by changing the port number that is listed in this command. Ports that must be blocked are in the 5001-5021 range.

ËÁÒÂà˵Ø:Do not forget to change the port number in the rule name (the-rswitch) and in the filter (the-fÊÇÔµªì)

Optional: Give access to the RPC Endpoint Mapper for specific subnets if access is needed

If you must give specific subnets access to the restricted RPC ports, you must first give these subnets access to the RPC Endpoint Mapper that you blocked earlier. To give a specific subnet access to the RPC Endpoint Mapper, use the following command:ËÁÒÂà˵Ø:In this command, the following statements apply:

• "%IPSECTOOL%" represents the command to use. This command is either "ipsecpol.exe" or "ipseccmd.exe." Which command is used depends upon which operating system you are configuring.
• "%SUBNET%" represents the remote IP subnet to which you want to give access, for example, 10.1.1.0.
• "%MASK%" represents the subnet mask to use, for example, 255.255.255.0.
  
  For example, the following command enables all hosts from the 10.1.1.0/255.255.255.0 subnet to connect to port TCP 135. All other hosts will have their connections denied by the default block rule that was created earlier for this port.

  %IPSECTOOL% -w REG -p "Block RPC Ports" -r "Allow Inbound TCP Port 135 from 10.1.1.0 Rule" -f 10.1.1.0/255.255.255.0=0:135:TCP -n PASS

Optional: Give access to the new RPC dynamic port range for specific subnets if access is needed

Each subnet that was given access to the RPC Endpoint Mapper earlier should also be given access to all the ports in the new RPC dynamic port range (5001-5021).

If you enable subnets to reach the RPC Endpoint Mapper but not the dynamic port range, the application may stop responding, or you may experience other problems.

The following command gives a specific subnet access to a port in the new RPC dynamic port range:ËÁÒÂà˵Ø:㹤ÓÊÑ觹Õé ¤ÓÊÑ觵èÍ仹Õéãªé:

• "% IPSECTOOL %" ËÁÒ¶֧¤ÓÊÑè§à¾×èÍ·Õèãªé ¤ÓÊÑ觹Õé¤×Í "ipsecpol.exe" ËÃ×Í "ipseccmd.exe" ãªé¤ÓÊÑè§ã´¢Öé¹àÁ×èÍÃкº»¯ÔºÑµÔ¡Ò÷Õè¤Ø³¡ÓÅѧ¡Ó˹´¤èÒ
• %¾ÍÃìµ "%" ËÁÒ¶֧¾ÍÃìµã¹ªèǧ¾ÍÃìµáººä´¹ÒÁÔ¡·Õè¡ÒùÓà¢éÒ
• "%à¤Ã×Í¢èÒÂÂèÍÂ%" ËÁÒ¶֧à¤Ã×Í¢èÒÂÃÐÂÐä¡Å IP ÂèÍ·Õè¤Ø³µéͧ¡ÒùÓà¢éÒ µÑÇÍÂèÒ§àªè¹ 10.1.1.0
• "%ÁÒÊ¡ì%" ËÁÒ¶֧«Ñºà¹çµÁÒÊ¡ì¡ÒÃãªé µÑÇÍÂèÒ§àªè¹ 255.255.255.0
  
  µÑÇÍÂèÒ§àªè¹ ¤ÓÊÑ觵èÍ仹Õé·ÓãËéâÎʵì·Ñé§ËÁ´¨Ò¡à¤Ã×Í¢èÒÂÂèÍ 10.1.1.0/255.255.255.0 àª×èÍÁµè͡Ѻ¾ÍÃìµ TCP 5001 âÎʵìÍ×è¹ æ ·Ñé§ËÁ´¨ÐÁÕ¡ÒÃàª×èÍÁµèÍ·Õè¶Ù¡»¯Ôàʸ â´Â¡®¡ÒúÅçÍ¡¤èÒàÃÔèÁµé¹·Õè¶Ù¡ÊÃéÒ§äÇé¡è͹˹éÒ¹ÕéÊÓËÃѺ¾ÍÃìµ¹Õé

  %IPSECTOOL% -w REG -p "Block RPC Ports" -r "Allow Inbound TCP Port 5001 from 10.1.1.0 Rule" -f 10.1.1.0/255.255.255.0=0:5001:TCP -n PASS

ËÁÒÂà˵Ø:¤ÓÊÑ觹Õé¤Çö١·Ó«éÓÊÓËÃѺáµèÅÐà¤Ã×Í¢èÒÂÂèÍÂáÅоÍÃìµã¹ªèǧ¾ÍÃìµáººä´¹ÒÁÔ¡ RPC ãËÁè

¡Ó˹´¹âºÒ IPsec

ËÁÒÂà˵Ø:¤ÓÊÑè§ã¹Êèǹ¹ÕéÁռŷѹ·Õ

ËÅѧ¨Ò¡·Õè¤Ø³ÊÃéÒ§¡®¡ÒúÅçÍ¡·Ñé§ËÁ´ áÅÐàÅ×Í¡·Ñé§ËÁ´·Õèä´éãËé¡®ÊÓËÃѺ RPC ·Õè¶Ù¡¡Ó˹´¤èÒ¾ÍÃìµ ¡Ó˹´¹âºÒÂä´é â´Â¡ÒÃãªé¤ÓÊÑ觵èÍ仹Õé:ËÁÒÂà˵Ø:àÁ×è͵éͧ¡ÒÃ㹷ѹ·Õ unassign ¹âºÒ ãªé¤ÓÊÑ觵èÍ仹Õé:ËÁÒÂà˵Ø:àÁ×è͵éͧ¡ÒÃź¹âºÒ¨ҡÃÕ¨ÔÊ·ÃÕ ãªé¤ÓÊÑ觵èÍ仹Õé:¤Ø³µéͧàÃÔèÁµé¹¡ÒÃâÎʵìÊÓËÃѺ¡ÒÃà»ÅÕè¹á»Å§ÁÕ¼Å

ËÁÒÂà˵Ø

• ¡ÒÃà»ÅÕè¹á»Å§¡ÒõÑ駤èҤ͹¿Ô¡ RPC ¨Óà»ç¹µéͧÁÕ¡ÒÃàÃÔèÁÃкº¤ÍÁ¾ÔÇàµÍÃìãËÁè
• ¡ÒÃà»ÅÕè¹á»Å§¹âºÒ IPsec Áռŷѹ·Õ áÅÐäÁè¨Óà»ç¹µéͧÁÕ¡ÒÃÃÕʵÒÃì·

ËÅѧ¨Ò¡·ÕèàÇÔÃì¡Ê൪ѹËÃ×Íà«ÔÃì¿àÇÍÃìÃÕʵÒÃìµ ÍÔ¹à·ÍÃìà¿«ã´ æ ¢Í§ RPC ·ÕèãªéÅӴѺ¢Í§â¾Ãâ·¤ÍÅ ncacn_ip_tcp áÅÐäÁèä´éÃкØ੾ÒоÍÃìµ TCP ·Õè¼Ù¡ ¨ÐÁÕ¡ÒûѹÊèǹ¨Ò¡ªèǧ¹Õé â´Â¡ÒÃãªé§Ò¹¨ÃÔ§ RPC àÁ×èÍàÃÔèÁµé¹à«ÔÃì¿àÇÍÃì RPC ¾ÍÃìµ

ËÁÒÂà˵Ø:à«ÔÃì¿àÇÍÃìÍÒ¨¨Óà»ç¹µéͧãªé¾ÍÃìµ TCP ÁÒ¡¡ÇèÒ 20 ¤Ø³ÊÒÁÒöãªéä´érpcdump.exe¤ÓÊÑè§ à¾×è͹Ѻ¨Ó¹Ç¹ RPC »ÅÒ·ҧ·Õè¶Ù¡¼Ù¡à¢éҡѺ¾ÍÃìµ TCP áÅÐà¾ÔèÁËÁÒÂàÅ¢¹Õé¶éҤسµéͧ¡Òà ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒâÍÃѺà¤Ã×èͧÁ×Í¡ÒöèÒÂâ͹¢éÍÁÙÅ RPC áÇÐä»·ÕèàÇçºä«µìµèÍ仹Õé¢Í§ Microsoft: