MS09-012: 2009³â 4¿ùÀÚ Windows Service Isolation¿ë º¸¾È ¾÷µ¥ÀÌÆ®¿¡ ´ëÇÑ ¼³¸í

• ÀÏ¹Ý »ç¿ëÀÚ:
  http://www.microsoft.com/korea/protect/computer/updates/bulletins/200904.mspx

  (http://www.microsoft.com/korea/protect/computer/updates/bulletins/200904.mspx)
  ¼¼ºÎ Á¤º¸ »ý·«: ´ÙÀ½ Microsoft Update À¥ »çÀÌÆ®¿¡¼­ °¡Á¤¿ë ÄÄÇ»ÅÍ ¾÷µ¥ÀÌÆ® ¶Ç´Â ·¦Åé¿ë ¾÷µ¥ÀÌÆ®¸¦ Áö±Ý ´Ù¿î·ÎµåÇϽʽÿÀ.
  http://update.microsoft.com/microsoftupdate/

  (http://update.microsoft.com/microsoftupdate/)
• IT Àü¹®°¡:
  http://www.microsoft.com/korea/technet/security/bulletin/MS09-012.mspx

  (http://www.microsoft.com/korea/technet/security/bulletin/MS09-012.mspx)

ÀÌ º¸¾È ¾÷µ¥ÀÌÆ®¿¡ ´ëÇÑ µµ¿ò°ú Áö¿øÀ» ¹Þ´Â ¹æ¹ý

À§·Î °¡±â | Çǵå¹é º¸³»±â

ÀÌ º¸¾È ¾÷µ¥ÀÌÆ®ÀÇ ¾Ë·ÁÁø ¹®Á¦

• Çö»ó
  CPU Äھ 5°³ ÀÌ»ó »ç¿ëÇϸç Microsoft ISA Server Standard EditionÀÌ ½ÇÇàµÇ´Â ¼­¹ö¿¡¼­ ÀÌ ¾÷µ¥ÀÌÆ®¸¦ Àû¿ëÇϸé Microsoft ISA Server Control ¼­ºñ½º°¡ ½ÃÀÛµÇÁö ¾Ê½À´Ï´Ù. ¶ÇÇÑ À̺¥Æ® ID 14109ÀÌ ÀÀ¿ë ÇÁ·Î±×·¥ ·Î±×¿¡ ±â·ÏµË´Ï´Ù.
  
  ¿øÀÎ
  ÀÌ ¹®Á¦´Â 2007³â 2¿ù 7ÀÏ ÀÌÈÄ¿¡ Ãâ½ÃµÈ ÇÖÇȽº¸¦ ÀÌ º¸¾È ¾÷µ¥ÀÌÆ® ¼³Ä¡ Àü¿¡ ¼³Ä¡ÇÒ °æ¿ì¿¡ ¹ß»ýÇÒ ¼ö ÀÖ½À´Ï´Ù. ÀÌ ¹®Á¦´Â Windows°¡ »ç¿ë °¡´ÉÇÑ CPU ¼ö¸¦ º¸°íÇÏ´Â ¹æ½ÄÀÌ º¯°æµÇ¾ú±â ¶§¹®¿¡ ¹ß»ýÇÕ´Ï´Ù. ÀÌ·¯ÇÑ º¯°æÀº ÇÖÇȽº 932730¿¡ óÀ½ µµÀԵǾú½À´Ï´Ù. ÀÌ·Î ÀÎÇØ Windows Server 2003Àº Windows Vista ¹× Windows Server 2008ÀÌ ÀÌ Á¤º¸¸¦ º¸°íÇÏ´Â °Í°ú Á¤È®È÷ °°Àº ¹æ½ÄÀ¸·Î Á¤º¸¸¦ º¸°íÇÕ´Ï´Ù. Windows°¡ 5°³ ÀÌ»óÀÇ CPU Äھ º¸°íÇϸé ISA Server Control ¼­ºñ½º´Â ÀÌ Á¤º¸¸¦ CPU°¡ 5°³ ÀÌ»ó ÀÖ´Â °ÍÀ¸·Î Çؼ®ÇÕ´Ï´Ù. ÀÌ·Î ÀÎÇØ °æ°í°¡ Æ®¸®°ÅµÇ¸ç Microsoft ISA Server Control ¼­ºñ½º ¹× Á¾¼Ó ¼­ºñ½º°¡ Á¾·áµË´Ï´Ù.
  
  Âü°í ÇÖÇȽº 932730ÀÌ Windows Server 2003 ¼­ºñ½º ÆÑ¿¡´Â Æ÷ÇÔµÇÁö ¾Ê¾Ò½À´Ï´Ù. ÇÖÇȽº 932730¿¡ ´ëÇÑ ÀÚ¼¼ÇÑ ³»¿ëÀº ´ÙÀ½ ¹®¼­ ¹øÈ£¸¦ Ŭ¸¯ÇÏ¿© Microsoft ±â¼ú ÀÚ·á ¹®¼­¸¦ ÂüÁ¶ÇϽʽÿÀ.
  932370

  (http://support.microsoft.com/kb/932370/ )

  Windows Server 2003¿¡¼­ ÇÏÀÌÆÛ½º·¹µùÀ» »ç¿ëÇÏ´Â ½ÇÁ¦ ÇÁ·Î¼¼¼­ ¼ö³ª ½ÇÁ¦ ¸ÖƼÄÚ¾î ÇÁ·Î¼¼¼­ ¼ö°¡ À߸ø º¸°íµÊ
  ÀÌ·¯ÇÑ ¹®Á¦ÀÇ ÇØ°á ¹æ¹ý¿¡ ´ëÇÑ ÀÚ¼¼ÇÑ ³»¿ëÀº ´ÙÀ½ Microsoft À¥ ÆäÀÌÁö¸¦ ÂüÁ¶ÇϽʽÿÀ.
  http://blogs.technet.com/isablog/archive/2009/04/18/ms09-012-and-isa-server-standard-edition-14109-failures.aspx

  (http://blogs.technet.com/isablog/archive/2009/04/18/ms09-012-and-isa-server-standard-edition-14109-failures.aspx)
  ISA Server 2004¿¡ ´ëÇØ ÀÌ ¹®Á¦¸¦ ÇØ°áÇÏ·Á¸é ÇÖÇȽº ·Ñ¾÷ 970454¸¦ ¼³Ä¡ÇϽʽÿÀ. ÀÌ ¹®Á¦¿¡ ´ëÇÑ ÀÚ¼¼ÇÑ ³»¿ëÀº ´ÙÀ½ ¹®¼­ ¹øÈ£¸¦ Ŭ¸¯ÇÏ¿© Microsoft ±â¼ú ÀÚ·á ¹®¼­¸¦ ÂüÁ¶ÇϽʽÿÀ.
  970454

  (http://support.microsoft.com/kb/970454/ )

  2009³â 6¿ù 2ÀÏÀÚ ISA Server 2004 ÇÖÇȽº ÆÐÅ°Áö¿¡ ´ëÇÑ ¼³¸í
  ISA Server 2004¿¡ ´ëÇØ ÀÌ ¹®Á¦¸¦ ÇØ°áÇÏ·Á¸é ÇÖÇȽº ·Ñ¾÷ 970441À» ¼³Ä¡ÇϽʽÿÀ. ÀÌ ¹®Á¦¿¡ ´ëÇÑ ÀÚ¼¼ÇÑ ³»¿ëÀº ´ÙÀ½ ¹®¼­ ¹øÈ£¸¦ Ŭ¸¯ÇÏ¿© Microsoft ±â¼ú ÀÚ·á ¹®¼­¸¦ ÂüÁ¶ÇϽʽÿÀ.
  970441

  (http://support.microsoft.com/kb/970441/ )

  ÇØ°á: Windows Server 2003ÀÌ ½ÇÇà ÁßÀÌ°í CPU Äھ 5°³ ÀÌ»ó ÀÖ´Â ÄÄÇ»ÅÍ¿¡ MS09-012 ¾÷µ¥ÀÌÆ®¸¦ ¼³Ä¡ÇÑ ÈÄ¿¡ ISA Server Control ¼­ºñ½º¸¦ ½ÃÀÛÇÒ ¼ö ¾øÀ½
  
  Âü°í ±âº»ÀûÀ¸·Î ISA Server 2000ÀÌ ´õ ÀÌ»ó Áö¿øµÇÁö ¾ÊÀ¸¸ç ÀÌ ¹®Á¦°¡ º¸¾È Ãë¾à¼ºÀ» À¯¹ßÇÏÁö ¾ÊÀ¸¹Ç·Î ISA Server 2000¿ë ÆÐÄ¡´Â Ãâ½ÃµÇÁö ¾Ê¾Ò½À´Ï´Ù.
• ÀÌ ¾÷µ¥ÀÌÆ®¸¦ Àû¿ëÇÑ ÈÄ¿¡ ÀÌÀü¿¡ Ãâ½ÃµÈ ¿î¿µ üÁ¦¿¡¼­ »õ ¿î¿µ üÁ¦·Î Àüü ¾÷±×·¹À̵带 ¼öÇàÇÏ¸é ´ÙÀ½ ·¹Áö½ºÆ®¸® ÇÏÀ§ Å°¿¡ »ç¿ëÀÚ°¡ Àû¿ëÇÑ º¯°æ ³»¿ëÀÌ º¸Á¸µÇÁö ¾ÊÀ» ¼ö ÀÖ½À´Ï´Ù.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\DefaultSecuredHost

  
  
  

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CompatibleHostProviders

  
  
  

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
  ¾Æ·¡¿Í °°Àº ¾÷±×·¹ÀÌµå °æ¿ì¿¡ ÀÌ·¯ÇÑ ¹®Á¦°¡ ¹ß»ýÇÒ ¼ö ÀÖ½À´Ï´Ù.
  • Windows XP¿¡¼­ Windows Vista·Î
  • Windows Server 2003¿¡¼­ Windows Server 2008·Î
  • Windows 2000 Server¿¡¼­ Windows Server 2003À¸·Î
  ¾Æ·¡¿Í °°Àº ¾÷±×·¹ÀÌµå °æ¿ì¿¡´Â ÀÌ·¯ÇÑ ¹®Á¦°¡ ¹ß»ýÇÏÁö ¾Ê½À´Ï´Ù.
  • Windows Vista¿¡¼­ Windows 7·Î
  • Windows Server 2008¿¡¼­ ÃֽŠ¼­ºñ½º ÆÑ ¶Ç´Â ÇâÈÄ Ãâ½ÃµÉ ¼­¹ö ±â¹Ý ¿î¿µ üÁ¦·Î ÀüȯµË´Ï´Ù.
  ÀÌ ¹®Á¦¸¦ ÇÇÇÏ·Á¸é Àüü ¾÷±×·¹À̵带 ¼öÇàÇϱâ Àü¿¡ ÀÌ·¯ÇÑ ÇÏÀ§ Å°ÀÇ ¹é¾÷À» ¸¸µì´Ï´Ù. ¾÷±×·¹À̵带 ¿Ï·áÇÏ°í ½Ã½ºÅÛÀ» º¸¾È ¾÷µ¥ÀÌÆ®·Î ÆÐÄ¡ÇÑ ÈÄ¿¡ ÇÏÀ§ Å° ¹é¾÷À» ´Ù½Ã Àû¿ëÇÕ´Ï´Ù.

ISV(µ¶¸³ ¼ÒÇÁÆ®¿þ¾î °ø±Þ¾÷ü)¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(COM)

1. »ç¿ë ÁßÀÎ Á¦Ç°ÀÌ NT ÀÌ¿ÜÀÇ ¼­ºñ½º COM ¼­¹ö ÇÁ·Î¼¼½º¸¦ ½ÃÀÛÇØ¾ß Çմϱî?
2. ±âº»ÀûÀ¸·Î Á¦Ç°ÀÌ ÀνºÅϽºÈ­ÇÏ´Â COM ¼­¹ö°¡ ³×Æ®¿öÅ© ¼­ºñ½º ¶Ç´Â ·ÎÄà ¼­ºñ½º °èÁ¤ÀÇ ÄÁÅؽºÆ®¿¡¼­ ½ÇÇàµË´Ï±î?

1. ´ÙÀ½ Microsoft À¥ »çÀÌÆ®¿¡¼­ Process Explorer¸¦ ´Ù¿î·ÎµåÇÑ ÈÄ ¼³Ä¡ÇÕ´Ï´Ù.
   http://technet.microsoft.com/ko-kr/sysinternals/bb896653.aspx

   (http://technet.microsoft.com/ko-kr/sysinternals/bb896653.aspx)
2. Process Explorer¸¦ ·ÎÄà °ü¸®ÀÚ ±ÇÇÑÀ¸·Î ½ÇÇàÇÕ´Ï´Ù.
3. View¸¦ Ŭ¸¯ÇÏ°í Lower Pane View¸¦ °¡¸®Å² ÈÄ Handles¸¦ Ŭ¸¯ÇÕ´Ï´Ù.
4. °ü½É ÀÖ´Â ¼­¹ö ÇÁ·Î¼¼½º¸¦ Ŭ¸¯ÇÑ ÈÄ ¾Æ·¡ÂÊ Ã¢¿¡¼­ Type = TokenÀ» È®ÀÎÇÕ´Ï´Ù.
5. Á¦Ç°¿¡ ´ëÇÑ ¸ðµç Å×½ºÆ®¸¦ ½ÇÇàÇÕ´Ï´Ù.
6. ¾Æ·¡ÂÊ Ã¢¿¡¼­ Á¦Ç°ÀÌ ¼ÒÀ¯ÇÏ´Â ¸ðµç ÅäÅ«À» È®ÀÎÇÏ¿© ½Ã½ºÅÛ ÅäÅ«ÀÌ Ä¸Ã³µÇ¾ú´ÂÁö ¿©ºÎ¸¦ ¾Ë¾Æº¾´Ï´Ù.

1. ´ÙÀ½ Microsoft À¥ »çÀÌÆ®¿¡¼­ Windows¿ë µð¹ö±ë µµ±¸¸¦ ´Ù¿î·ÎµåÇÑ ÈÄ ¼³Ä¡ÇÕ´Ï´Ù.
   http://www.microsoft.com/whdc/devtools/debugging/default.mspx

   (http://www.microsoft.com/whdc/devtools/debugging/default.mspx)
2. WinDBG.exe¸¦ ·ÎÄà °ü¸®ÀÚ ±ÇÇÑÀ¸·Î ½ÇÇàÇÕ´Ï´Ù.
3. FileÀ» Ŭ¸¯ÇÑ ÈÄ Kernel Debug¸¦ Ŭ¸¯ÇÏ¿© ·ÎÄà Ŀ³Î µð¹ö°Å¸¦ ½ÃÀÛÇÕ´Ï´Ù.
4. FileÀ» Ŭ¸¯ÇÏ°í Attach to a Process¸¦ Ŭ¸¯ÇÕ´Ï´Ù.
5. °ü½É ÀÖ´Â ¼­¹ö ÇÁ·Î¼¼½º¸¦ Ŭ¸¯ÇÑ ÈÄ OK¸¦ Ŭ¸¯ÇÏ¿© ¼­¹ö ÇÁ·Î¼¼½º¿¡ ¿¬°áÇÕ´Ï´Ù.
6. ´ÙÀ½°ú °°ÀÌ µð¹ö°Å ±âÈ£ °æ·Î¸¦ ¼³Á¤ÇÕ´Ï´Ù. DownstreamStore¸¦ ´Ù¿î½ºÆ®¸² ÀúÀå¼Ò °æ·Î·Î ¹Ù²ß´Ï´Ù. ¿¹: C:\Symbols.
   
   SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
7. ÇÁ·Î¼¼½º ÅäÅ« Á¤º¸¸¦ ´ýÇÁÇÕ´Ï´Ù.
   ÇÁ·Î¼¼½º Ãâ·Â¿¡¼­ ÅäÅ« ÁÖ¼Ò¸¦ °¡Á®¿Â ÈÄ dt nt!_TOKEN ¸í·ÉÀ» »ç¿ëÇÏ¿© TOKEN ±¸Á¶ÀÇ °³º° ÇÊµå ¸ñ·ÏÀ» Ç¥½ÃÇÕ´Ï´Ù.
8. ÅäÅ«ÀÇ ImpersonationLevel Çʵ带 È®ÀÎÇÕ´Ï´Ù.

• MSRC ÆÐÅ°Áö¸¦ ¼³Ä¡ÇÕ´Ï´Ù.
• COM ¼­¹öÀÇ ±¸¼ºÀ» ´ÙÀ½°ú °°ÀÌ º¯°æÇÕ´Ï´Ù.
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{APPIDGUID} REG_DWORD AppIDFlags 0x2 /* AppIDFlags ·¹Áö½ºÆ®¸® °ª »ç¿ëÀÇ ¿¹ HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{60EE1F45-C0DD-4A1F-AA44-D97424600A16} REG_DWORD AppIDFlags 0x2 */
  Âü°í º¯°æÀ» ¼öÇàÇÏ·Á¸é ·ÎÄà °ü¸®ÀÚ ÀÚ°Ý Áõ¸íÀÌ ÇÊ¿äÇÕ´Ï´Ù.
  
  ±ÇÇÑÀÌ ºÎ¿©µÈ ÅäÅ«À» Æ÷ÇÔÇÏ´Â NS/LS COM ¼­¹ö°¡ NT ¼­ºñ½º°¡ ¾Æ´Ï°Å³ª ½ÇÇà COM ¼­¹ö°¡ ¾Æ´Ï¸é Ãë¾à¼ºÀ» ¸·±â À§ÇØ ´ÙÀ½ ±¸¼º Áß Çϳª·Î º¯È¯ÇØ¾ß ÇÕ´Ï´Ù.

• ¼³Ä¡ °ü¸®ÀÚ´Â ´ÙÀ½ ·¹Áö½ºÆ®¸® Å°°¡ ÀÖ´ÂÁö¸¦ È®ÀÎÇÕ´Ï´Ù.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\KB956572
  ÀÌ ·¹Áö½ºÆ®¸® Ç׸ñÀÌ ÀÖÀ¸¸é º¸¾È ¾÷µ¥ÀÌÆ® 956572°¡ ½Ã½ºÅÛ¿¡ ÀÖ´Â °ÍÀÔ´Ï´Ù.

½Ã½ºÅÛ °ü¸®ÀÚ¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(COM)

1. »ç¿ë ÁßÀÎ Á¦Ç°ÀÌ NT ÀÌ¿ÜÀÇ ¼­ºñ½º COM ¼­¹ö ÇÁ·Î¼¼½º¸¦ ½ÃÀÛÇØ¾ß Çմϱî?
2. ±âº»ÀûÀ¸·Î Á¦Ç°ÀÌ ½ÃÀÛÇÏ´Â COM ¼­¹ö°¡ ³×Æ®¿öÅ© ¼­ºñ½º ¶Ç´Â ·ÎÄà ¼­ºñ½º °èÁ¤ÀÇ ÄÁÅؽºÆ®¿¡¼­ ½ÇÇàµË´Ï±î?

ISV¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(Services.exe)

1. »ç¿ë ÁßÀÎ Á¦Ç°ÀÌ SCM ÇÁ·¹ÀÓ¿öÅ©¸¦ »ç¿ëÇÏ¿© ½ÃÀ۵Ǵ ¼­ºñ½º¸¦ ¼³Ä¡Çմϱî?
2. ±âº»ÀûÀ¸·Î Á¦Ç°ÀÌ ¼³Ä¡ÇÏ´Â ¼­ºñ½º°¡ ³×Æ®¿öÅ© ¼­ºñ½º ¶Ç´Â ·ÎÄà ¼­ºñ½º °èÁ¤ÀÇ ÄÁÅؽºÆ®¿¡¼­ ½ÇÇàµË´Ï±î?
3. ¼­ºñ½º°¡ Windows Vista ¶Ç´Â Windows Server 2008¿¡¼­ ½ÇÇàµÇ´Â °æ¿ì ±ÇÇÑÀÌ »ó½ÂµÈ ¸í·É ÇÁ·ÒÇÁÆ®¿¡¼­ ´ÙÀ½ ¸í·ÉÀ» ½ÇÇàÇÕ´Ï´Ù.
   SC.EXE QSIDTYPE <ServiceName>
   SERVICE_SID_TYPE °ªÀÌ NONEÀԴϱî?
   
   °á°ú:

   [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: <Service Name> SERVICE_SID_TYPE: NONE 

   ÀÌ·¯ÇÑ ¼¼ °¡Áö Áú¹®¿¡ ´ëÇÑ ´äÀÌ ¿¹ÀÌ¸é »ç¿ë ÁßÀÎ ¼­ºñ½º´Â Ãë¾àÇÒ ¼ö ÀÖ½À´Ï´Ù. »ç¿ë ÁßÀÎ ¼­ºñ½º°¡ Ãë¾àÇÑÁö ¿©ºÎ¸¦ °è¼Ó È®ÀÎÇÏ·Á¸é "ISV(µ¶¸³ ¼ÒÇÁÆ®¿þ¾î °ø±Þ¾÷ü)¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(COM)" ÀýÀÇ ´ë´ä 1¿¡ ³ª¿À´Â Process Explorer °ü·Ã ´Ü°è¸¦ ´Ù¸£½Ê½Ã¿À.

• MSRC ÆÐÅ°Áö¸¦ ¼³Ä¡ÇÕ´Ï´Ù.
• ±ÇÇÑÀÌ »ó½ÂµÈ ¸í·É ÇÁ·ÒÇÁÆ®¿¡¼­ ´ÙÀ½ ¸í·ÉÀ» ½ÇÇàÇÕ´Ï´Ù.
  SC.exe SIDTYPE <¼­ºñ½º À̸§> UNRESTRICTED
• ¼­ºñ½º Á¦¾î °ü¸®ÀÚ¿¡¼­ ¼­ºñ½º¸¦ ´Ù½Ã ½ÃÀÛÇÕ´Ï´Ù.
• ´ÙÀ½ ¸í·ÉÀ» ½ÇÇàÇÏ¿© ¼­ºñ½º°¡ ¼­ºñ½º SID¸¦ ȹµæÇß´ÂÁö È®ÀÎÇÕ´Ï´Ù.
  SC.exe QSIDTYPE <¼­ºñ½º À̸§>
  Ãâ·Â:

  [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: <¼­ºñ½º À̸§> SERVICE_SID_TYPE: UNRESTRICTED 

• SERVICE_SID_TYPE = UNRESTRICTEDÀÌ¸é ¼­ºñ½º°¡ SID¸¦ ȹµæÇÑ °ÍÀÔ´Ï´Ù.
• ¸ðµç Å×½ºÆ®¸¦ ½ÇÇàÇÏ¿© ¼­ºñ½º°¡ Á¦°øÇÑ ¸ðµç ±â´ÉÀÌ Àß ÀÛµ¿ÇÏ´ÂÁö È®ÀÎÇÕ´Ï´Ù.
• ´ÙÀ½ ¸í·É ½ÃÄö½º´Â ¼­ºñ½ºÀÇ ¼­ºñ½º SID¸¦ Á¦°ÅÇϵµ·Ï µµ¿ÍÁÝ´Ï´Ù.
  SC.exe SIDTYPE <¼­ºñ½º À̸§> NONE
  SC.exe STOP <¼­ºñ½º À̸§>
  net start <¼­ºñ½º À̸§>

1. ´ÙÀ½ ·¹Áö½ºÆ®¸® Å°¸¦ º¯°æÇÕ´Ï´Ù.
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\ServiceSidType = 1
2. ÀÌ ¾÷µ¥ÀÌÆ®¸¦ ¼³Ä¡ÇÑ ÈÄ¿¡ ¼³Ä¡ °ü¸®ÀÚ´Â ½Ã½ºÅÛÀ» ´Ù½Ã ½ÃÀÛÇÕ´Ï´Ù.

• ¼³Ä¡ °ü¸®ÀÚ´Â ´ÙÀ½ ·¹Áö½ºÆ®¸® Å°°¡ ÀÖ´ÂÁö¸¦ È®ÀÎÇÕ´Ï´Ù.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\KB956572
  ÀÌ ·¹Áö½ºÆ®¸® Ç׸ñÀÌ ÀÖÀ¸¸é º¸¾È ¾÷µ¥ÀÌÆ® 956572°¡ ½Ã½ºÅÛ¿¡ ÀÖ´Â °ÍÀÔ´Ï´Ù.

½Ã½ºÅÛ °ü¸®ÀÚ¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(Services.exe)

1. »ç¿ë ÁßÀÎ Á¦Ç°ÀÌ SCM ÇÁ·¹ÀÓ¿öÅ©¸¦ »ç¿ëÇÏ¿© ½ÃÀ۵Ǵ ¼­ºñ½º¸¦ ¼³Ä¡Çմϱî?
2. ±âº»ÀûÀ¸·Î Á¦Ç°ÀÌ ¼³Ä¡ÇÏ´Â ¼­ºñ½º°¡ ³×Æ®¿öÅ© ¼­ºñ½º ¶Ç´Â ·ÎÄà ¼­ºñ½º °èÁ¤ÀÇ ÄÁÅؽºÆ®¿¡¼­ ½ÇÇàµË´Ï±î?
   
   Âü°í ¼­ºñ½º°¡ Windows Vista ¶Ç´Â Windows Server 2008¿¡¼­ ½ÇÇàµÇ´Â °æ¿ì ±ÇÇÑÀÌ »ó½ÂµÈ ¸í·É ÇÁ·ÒÇÁÆ®¿¡¼­ ´ÙÀ½ ¸í·ÉÀ» ½ÇÇàÇÏ¿© ÄÁÅؽºÆ®¸¦ È®ÀÎÇÕ´Ï´Ù.
   SC.exe QSIDTYPE <¼­ºñ½º À̸§>
   Ãâ·Â:

   [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: <¼­ºñ½º À̸§> SERVICE_SID_TYPE: UNRESTRICTED 

   ÀÌ·¯ÇÑ ¼¼ °¡Áö Áú¹®¿¡ ´ëÇÑ ´äÀÌ ¿¹ÀÌ¸é ¼­ºñ½º´Â Ãë¾àÇÒ ¼ö ÀÖ½À´Ï´Ù. ÀÌ·¯ÇÑ ¼­ºñ½ºÀÇ º¸¾ÈÀ» À¯ÁöÇÏ·Á¸é ¼­ºñ½º¸¦ ¼ÒÀ¯ÇÏ´Â ISV¿¡ ¹®ÀÇÇϽʽÿÀ. ¼­ºñ½º°¡ »ç³»¿¡¼­ °³¹ßµÇ¾úÀ¸¸é "ISV(µ¶¸³ ¼ÒÇÁÆ®¿þ¾î °ø±Þ¾÷ü)¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(COM)" ÀýÀÇ ´ë´ä 1¿¡ ³ª¿À´Â ´Ü°è¸¦ µû¸£½Ê½Ã¿À.

ISV(µ¶¸³ ¼ÒÇÁÆ®¿þ¾î °ø±Þ¾÷ü)¸¦ À§ÇÑ Áú¹®°ú ´ë´ä(WMI)

1. WMI °ø±ÞÀÚ¿¡ ´ëÇÑ ".mof" ÆÄÀÏÀ» ¿­°í °ø±ÞÀÚÀÇ È£½ºÆà ¸ðµ¨ÀÌ ´ÙÀ½ Áß ÇϳªÀÎÁö¸¦ È®ÀÎÇÕ´Ï´Ù.
   • NetworkServiceHost
   • NetworkServiceHostToSelfHost
   • LocalServiceHost
   • NULL(Windows Vista ¶Ç´Â Windows Server 2008¿¡¸¸ ÇØ´ç)
2. ÅäÅ« Å°µå³À ÆÐÅ°Áö¿¡ ¼ÓÇÏ´Â WMI °ø±ÞÀÚ Á¦°ø ¹ÞÀº ÆíÁöÇÔ¸¸ ±âº»ÀûÀ¸·Î º¸¾ÈÀÌ À¯ÁöµË´Ï´Ù. °ø±ÞÀÚ°¡ ¹ÞÀº ÆíÁöÇÔ °ø±ÞÀÚÀ̸é ÅäÅ« Å°µå³À ÆÐÅ°Áö¸¦ ¼³Ä¡ÇÑ ÈÄ¿¡ º¸¾ÈÀÌ À¯ÁöµË´Ï´Ù. À̸¦ È®ÀÎÇÏ·Á¸é HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders ÇÏÀ§ Å° ¾Æ·¡ÀÇ ·¹Áö½ºÆ®¸® °ªÀ» °ËÅäÇϽʽÿÀ. °ø±ÞÀÚÀÇ º¸¾ÈÀÌ À¯ÁöµÇ´Â °æ¿ì ´ÙÀ½°ú ºñ½ÁÇÑ Ç׸ñÀÌ Ç¥½ÃµË´Ï´Ù.

   <³×ÀÓ½ºÆäÀ̽º>:_Win32Provider.Name ="<°ø±ÞÀÚ À̸§>" 	REG_SZ 	0.

3. °ø±ÞÀÚ°¡ ¿©±â¿¡ Ç¥½ÃµÉ °æ¿ì ÇØ´ç ƯÁ¤ °ø±ÞÀÚ´Â º¸¾È ¸ðµå¿¡¼­ ½ÇÇàµË´Ï´Ù.
4. °ø±ÞÀÚ À̸§ÀÌ SecureHostProviders ·¹Áö½ºÆ®¸® Å° ¾Æ·¡¿¡ ¾ø°í È£½ºÆà ¸ðµ¨ÀÌ 1´Ü°è¿¡ ³ª¿­µÈ ¸ðµ¨ Áß ÇϳªÀ̸é ÀÌ °ø±ÞÀÚ´Â º¸¾ÈµÇÁö ¾Ê´Â Wmiprvse.exe¿¡¼­ ½ÇÇàµÇ¸ç ÄÄÇ»ÅÍ´Â ÅäÅ« Å°µå³À °ø°Ý¿¡ Ãë¾àÇØÁý´Ï´Ù.

1. Á¦Ç°ÀÌ ¼³Ä¡µÈ ÄÄÇ»ÅÍ¿¡ °ü¸®ÀÚ ±ÇÇÑÀ¸·Î ·Î±×¿ÂÇÕ´Ï´Ù.
2. ´ÙÀ½ Microsoft À¥ »çÀÌÆ®¿¡¼­ Process Explorer¸¦ ´Ù¿î·ÎµåÇÑ ÈÄ ¼³Ä¡ÇÕ´Ï´Ù.
   http://technet.microsoft.com/ko-kr/sysinternals/bb896653.aspx

   (http://technet.microsoft.com/ko-kr/sysinternals/bb896653.aspx)
3. Process Explorer¸¦ ·ÎÄà °ü¸®ÀÚ ±ÇÇÑÀ¸·Î ½ÇÇàÇÕ´Ï´Ù.
4. View¸¦ Ŭ¸¯ÇÏ°í Lower Pane View¸¦ °¡¸®Å² ÈÄ Handles¸¦ Ŭ¸¯ÇÕ´Ï´Ù.
5. ÀÛ¾÷ °ü¸®ÀÚ¸¦ »ç¿ëÇÏ¿© ³×Æ®¿öÅ© ¼­ºñ½º ¶Ç´Â ·ÎÄà ¼­ºñ½º ÄÁÅؽºÆ®¿¡¼­ ½ÇÇàµÇ°í ÀÖ´Â ¸ðµç Wmiprvse.exe ÇÁ·Î¼¼½º¸¦ È®ÀÎÇÑ ÈÄ ´Ý½À´Ï´Ù.
6. ƯÁ¤ WMI °ø±ÞÀÚ¸¦ »ç¿ëÇÏ¿© WMI Äõ¸®¸¦ ½ÇÇàÇÏ´Â ÀÀ¿ë ÇÁ·Î±×·¥¿¡ ´ëÇØ Å×½ºÆ®¸¦ ½ÇÇàÇÕ´Ï´Ù. ÀÌ·¸°Ô ÇÏ¸é ¹æ±Ý ½ÇÇàÇÑ »õ·Î¿î WMI Äõ¸®¸¦ ó¸®Çϱâ À§ÇÑ »õ·Î¿î WMIPrvSE.exe ÇÁ·Î¼¼½º°¡ ¸¸µé¾îÁý´Ï´Ù.
7. Process Explorer µµ±¸ ¸ðÀ½¿¡¼­ View DLLsÀ» ¼±ÅÃÇß´ÂÁö È®ÀÎÇÕ´Ï´Ù.
8. ¾Æ·¡ÂÊ Ã¢¿¡¼­ »õ·Î ¸¸µç WMIPrvSE.exe¿¡ DLLÀÌ ·ÎµåµÇ¾ú´ÂÁö È®ÀÎÇÕ´Ï´Ù.
9. WMIPrvSE.exe¸¦ µÎ ¹ø Ŭ¸¯ÇÏ¿© Properties ´ëÈ­ »óÀÚ¸¦ ¿±´Ï´Ù.
10. Security ÅÇÀ» Ŭ¸¯ÇÏ°í ´ÙÀ½ ³»¿ë°ú ÀÏÄ¡ÇÏ´ÂÁö È®ÀÎÇÕ´Ï´Ù.
    • ·Î±×¿Â SIDÀÇ Çü½ÄÀº (S-1-5-5-****)ÀÔ´Ï´Ù.
    • ·Î±×¿Â SID´Â ¼ÒÀ¯Àڷεµ Ç¥½ÃµÇ¾î ÀÖ½À´Ï´Ù.
    • ServiceAcccount {Local Service|Network Service}¿¡ ´ëÇÑ WMI SID°¡ ¼ÒÀ¯ÀڷΠǥ½ÃµË´Ï´Ù.
      • ·ÎÄà ¼­ºñ½º¿¡ ´ëÇÑ WMI SID:
        S-1-5-86-1544737700-199408000-2549878335-3519669259-381336952
      • ³×Æ®¿öÅ© ¼­ºñ½º¿¡ ´ëÇÑ WMI SID:
        S-1-5-86-615999462-62705297-2911207457-59056572-3668589837
11. PermissionÀ» Ŭ¸¯ÇÏ°í ³×Æ®¿öÅ© ¼­ºñ½º¿Í ·ÎÄà ¼­ºñ½º°¡ µÑ ´Ù ¸ñ·Ï¿¡ ¾ø´ÂÁö È®ÀÎÇÕ´Ï´Ù. ÀÌ °æ¿ì °ø±ÞÀÚ°¡ º¸¾È ¸ðµå¿¡¼­ ½ÇÇàµÇ°í ÀÖ´Â °ÍÀÔ´Ï´Ù.

• HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
  
  ÀÌ Å° ¾Æ·¡¿¡ ³ª¿­µÈ ¸ðµç °ø±ÞÀÚ´Â Ç×»ó º¸¾È ¸ðµå¿¡¼­ ½ÇÇàµË´Ï´Ù.
• HKLM \SOFTWARE\Microsoft\WBEM\CIMOM\CompatibleHostProviders
  
  ÀÌ Å° ¾Æ·¡¿¡ Ç¥½ÃµÇ´Â °ø±ÞÀÚ´Â ºñº¸¾È ¸ðµå¿¡¼­ ½ÇÇàµË´Ï´Ù. ÀÌ Å°´Â ISV°¡ ¾ÈÀü ¸ðµå¿¡¼­ ½ÇÇàµÉ ¶§ ȣȯ¼º ¹®Á¦°¡ Àִ ƯÁ¤ °ø±ÞÀÚ¿¡ ´ëÇÑ ¿¹¿Ü¸¦ Ãß°¡ÇÒ ¼ö ÀÖµµ·Ï Çϱâ À§ÇØ Á¦°øµË´Ï´Ù. ±âº»ÀûÀ¸·Î ÀÌ Å°¿¡´Â 0°³ÀÇ Ç׸ñÀÌ Æ÷ÇԵ˴ϴÙ.
• HKLM \SOFTWARE\Microsoft\WBEM\CIMOM\DefaultSecuredHost
  
  ÀÌ Àü¿ª ·¹Áö½ºÆ®¸® Å°¸¦ 1·Î ¼³Á¤Çϸé À§ÀÇ ·¹Áö½ºÆ®¸® Å°¿¡ ³ª¿­µÇ´ÂÁö ¿©ºÎ¿¡ °ü°è¾øÀÌ, ÄÄÇ»ÅÍÀÇ ¸ðµç WMI °ø±ÞÀÚ°¡ º¸¾È ¸ðµå¿¡¼­ ½ÇÇàµË´Ï´Ù. ÀÌ ·¹Áö½ºÆ®¸® Å°¸¦ 1·Î ¼³Á¤ÇÑ »óÅ¿¡¼­ °¡´ÉÇÑ ¸ðµç Ÿ»ç ÀÀ¿ë ÇÁ·Î±×·¥ÀÇ µ¿ÀÛÀ» Å×½ºÆ®ÇÑ °ÍÀº ¾Æ´Ï¹Ç·Î Microsoft´Â ±âº»ÀûÀ¸·Î ÀÌ Å°¸¦ 1·Î ¼³Á¤ÇÏÁö ¾Ê¾Ò½À´Ï´Ù.

<³×ÀÓ½ºÆäÀ̽º>:_Win32Provider.Name =¡±<°ø±ÞÀÚ À̸§>¡± 	REG_SZ 	0.

½Ã½ºÅÛ °ü¸®ÀÚ¿¡ ´ëÇÑ Áú¹®°ú ´ë´ä(WMI)

1. Á¦Ç°ÀÌ ¼³Ä¡µÈ ÄÄÇ»ÅÍ¿¡ °ü¸®ÀÚ ±ÇÇÑÀ¸·Î ·Î±×¿ÂÇÕ´Ï´Ù.
2. ´ÙÀ½ Microsoft À¥ »çÀÌÆ®¿¡¼­ Process Explorer¸¦ ´Ù¿î·ÎµåÇÑ ÈÄ ¼³Ä¡ÇÕ´Ï´Ù.
   http://technet.microsoft.com/ko-kr/sysinternals/bb896653.aspx

   (http://technet.microsoft.com/ko-kr/sysinternals/bb896653.aspx)
3. Process Explorer¸¦ ·ÎÄà °ü¸®ÀÚ ±ÇÇÑÀ¸·Î ½ÇÇàÇÕ´Ï´Ù.
4. View¸¦ Ŭ¸¯ÇÏ°í Lower Pane View¸¦ °¡¸®Å² ÈÄ Handles¸¦ Ŭ¸¯ÇÕ´Ï´Ù.
5. ÀÛ¾÷ °ü¸®ÀÚ¸¦ »ç¿ëÇÏ¿© ³×Æ®¿öÅ© ¼­ºñ½º ¶Ç´Â ·ÎÄà ¼­ºñ½º ÄÁÅؽºÆ®¿¡¼­ ½ÇÇàµÇ°í ÀÖ´Â ¸ðµç Wmiprvse.exe ÇÁ·Î¼¼½º¸¦ È®ÀÎÇÑ ÈÄ ´Ý½À´Ï´Ù.
6. ƯÁ¤ WMI °ø±ÞÀÚ¸¦ »ç¿ëÇÏ¿© WMI Äõ¸®¸¦ ½ÇÇàÇÏ´Â ÀÀ¿ë ÇÁ·Î±×·¥¿¡ ´ëÇØ Å×½ºÆ®¸¦ ½ÇÇàÇÕ´Ï´Ù. ÀÌ·¸°Ô ÇÏ¸é ¹æ±Ý ½ÇÇàÇÑ »õ·Î¿î WMI Äõ¸®¸¦ ó¸®Çϱâ À§ÇÑ »õ·Î¿î WMIPrvSE.exe ÇÁ·Î¼¼½º°¡ ¸¸µé¾îÁý´Ï´Ù.
7. Process Explorer µµ±¸ ¸ðÀ½¿¡¼­ View DLLsÀ» ¼±ÅÃÇß´ÂÁö È®ÀÎÇÕ´Ï´Ù.
8. ¾Æ·¡ÂÊ Ã¢¿¡¼­ »õ·Î ¸¸µç WMIPrvSE.exe¿¡ DLLÀÌ ·ÎµåµÇ¾ú´ÂÁö È®ÀÎÇÕ´Ï´Ù.
9. WMIPrvSE.exe¸¦ µÎ ¹ø Ŭ¸¯ÇÏ¿© Properties ´ëÈ­ »óÀÚ¸¦ ¿±´Ï´Ù.
10. Security ÅÇÀ» Ŭ¸¯ÇÏ°í ´ÙÀ½ ³»¿ë°ú ÀÏÄ¡ÇÏ´ÂÁö È®ÀÎÇÕ´Ï´Ù.
    1. "³×Æ®¿öÅ© ¼­ºñ½º" ¶Ç´Â "·ÎÄà ¼­ºñ½º"´Â Wmiprvse.exe ÇÁ·Î¼¼½º¿¡ ´ëÇØ ¸ðµç »ç¿ë ±ÇÇÑÀ» °®½À´Ï´Ù.
    2. ·Î±×¿Â SID(S-1-5-5-**** Çü½Ä)°¡ ¼ÒÀ¯ÀڷΠǥ½ÃµÇÁö ¾Ê´ÂÁö È®ÀÎÇÕ´Ï´Ù.
    3. ServiceAcccount {Local Service|Network Service}ÀÇ WMI SID°¡ »ý¼ºµÇÁö ¾Ê¾Ò´ÂÁö È®ÀÎÇÕ´Ï´Ù. Áï, ÇØ´ç WMI SID°¡ "Group" ¾Æ·¡¿¡ Ç¥½ÃµÇÁö ¾Ê´ÂÁö È®ÀÎÇÕ´Ï´Ù.
       • ·ÎÄà ¼­ºñ½º¿¡ ´ëÇÑ WMI SID: S-1-5-86-1544737700-199408000-2549878335-3519669259-381336952
       • ³×Æ®¿öÅ© ¼­ºñ½º¿¡ ´ëÇÑ WMI SID: S-1-5-86-615999462-62705297-2911207457-59056572-3668589837

1. ·¹Áö½ºÆ®¸® ÆíÁý±â¸¦ ¿±´Ï´Ù.
2. ´ÙÀ½ ·¹Áö½ºÆ®¸® ÇÏÀ§ Å°·Î À̵¿ÇÕ´Ï´Ù.
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
3. º¸¾ÈÀ» À¯ÁöÇÒ WMI °ø±ÞÀÚ¿¡ ´ëÇÑ ·¹Áö½ºÆ®¸® Å°¸¦ Ãß°¡ÇÕ´Ï´Ù. ´ÙÀ½°ú °°Àº Çü½ÄÀ» »ç¿ëÇÕ´Ï´Ù.

   <³×ÀÓ½ºÆäÀ̽º>:_Win32Provider.Name =¡±<°ø±ÞÀÚ À̸§>¡± 	REG_SZ 	0

4. ´ÙÀ½ ¸í·ÉÀ» ½ÇÇàÇÏ¿© WMI ¼­ºñ½º¸¦ ´Ù½Ã ½ÃÀÛÇÕ´Ï´Ù.
   • Sc stop winmgmt
   • Sc start winmgmt

À§·Î °¡±â | Çǵå¹é º¸³»±â

• ƯÁ¤ Áß¿ä ½ÃÁ¡(RTM, SPn)ÀÌ Àû¿ëµÇ´Â ÆÄÀÏÀº "SP ¿ä±¸ »çÇ×" ¿­¿¡ ±â·ÏµÇ¾î ÀÖ½À´Ï´Ù.
• ÀÌ ¼ÒÇÁÆ®¿þ¾î ¾÷µ¥ÀÌÆ®´Â ÀÌ·¯ÇÑ Ç¥¿¡ ³ª¿­µÈ ÆÄÀÏ ¿Ü¿¡ Microsoft µðÁöÅÐ ¼­¸íÀ¸·Î ¼­¸íµÈ °ü·Ã º¸¾È Ä«Å»·Î±× ÆÄÀÏ(KB¹øÈ£.cat)À» ¼³Ä¡ÇÕ´Ï´Ù.

• ƯÁ¤ Á¦Ç°, Áß¿ä ½ÃÁ¡(RTM, SPn)¿¡ Àû¿ëµÇ´Â ÆÄÀÏÀº ´ÙÀ½ Ç¥¿¡ ³ª¿À´Â °Íó·³ ÆÄÀÏ ¹öÀü ¹øÈ£¸¦ °ËÅäÇÏ¿© È®ÀÎÇÒ ¼ö ÀÖ½À´Ï´Ù.
  Ç¥ Ãà¼ÒÇ¥ È®´ë

  ¹öÀü	Á¦Ç°	Áß¿ä ½ÃÁ¡	¼­ºñ½º ºÐ±â
  6.0.6000. 20xxx	Windows Vista	RTM	LDR
  6.0.6001. 22xxx	Windows Vista SP1 ¹× Windows Server 2008 SP1	SP1	LDR

• ¼­ºñ½º ÆÑ 1Àº ¿ø·¡ ¸±¸®½º ¹öÀüÀÇ Windows Server 2008¿¡ ÅëÇյǹǷΠRTM Áß¿ä ½ÃÁ¡ ÆÄÀÏÀº Windows Vista¿¡¸¸ Àû¿ëµË´Ï´Ù. RTM Áß¿ä ½ÃÁ¡ ÆÄÀÏÀÇ ¹öÀü ¹øÈ£´Â 6.0.0000.xxxxxxÀÔ´Ï´Ù.
• °¢ ȯ°æ¿¡ ´ëÇØ ¼³Ä¡µÈ MANIFEST ÆÄÀÏ(.manifest) ¹× MUM ÆÄÀÏ(.mum)Àº º°µµ·Î ³ª¿­µË´Ï´Ù. MUM ¹× MANIFEST ÆÄÀÏ°ú °ü·Ã º¸¾È Ä«Å»·Î±×(.cat) ÆÄÀÏÀº ¾÷µ¥ÀÌÆ®µÈ ±¸¼º ¿ä¼ÒÀÇ »óŸ¦ À¯Áö °ü¸®ÇÏ´Â µ¥ Áß¿äÇÕ´Ï´Ù. º¸¾È Ä«Å»·Î±× ÆÄÀÏ(Ư¼ºÀº ³ª¿­µÇÁö ¾ÊÀ½)Àº Microsoft µðÁöÅÐ ¼­¸íÀ¸·Î ¼­¸íµË´Ï´Ù.