Benefits of Uses Critical Windows RPC Vulnerability | CalCom Software
                     Benefits of Uses 
CriticalWindows 
RPC Vulnerability
Critical Windows RPC Vulnerability   
What is Windows RPC Vulnerability!
Critical Windows RPC Vulnerability is One of the 
vulnerabilities that Microsoft patched this week 
as part of its recurring patching schedule 
causes the security industry great concern. The 
Windows Remote Procedure Call (RPC) runtime 
contains a serious remote code execution 
(RCE) vulnerability. The vulnerability, identified 
as CVE-2022-26809, can be used over the 
network without requiring user involvement 
and may leverage several protocols as a 
trigger. As some Windows programmes use 
RPC to communicate with one another over 
networks, it is the kind of vulnerability that has 
historically given rise to significant botnets.
How to RPC Works 
A client application can call a procedure exposed by 
a server application using the standardised RPC way 
without having to worry about the underlying 
network. Many Windows services and features rely 
on RPC locally, and the two apps might even be 
running on the same system. Even Microsoft has a 
support article that advises against turning off RPC.
TCP 135 is the common communication port employed 
by MSRPC. RPC communication can, however, be 
tunnelled through other protocols like SMB/CIFS, HTTP, or 
TCP on other ports. Because of this, Microsoft advises 
enterprises to restrict port 445 at their network 
perimeters because the impacted component can be 
accessed via TCP port 445, which is often used by the 
SMB protocol.
TCP port 135 is mentioned in some organisations' 
advisories, including Trend Micro's Zero Day Initiative 
(ZDI), which raises some questions. Others questioned 
whether SMB over QUIC, which tunnels SMB traffic via 
TLS-encrypted UDP port 443, as well as TCP port 139, 
which is also connected to SMB and NetBIOS, would be 
attack points. It would be impossible to block that port 
at the network's edge because doing so would 
effectively block all HTTPS traffic.
The exposure would be substantial even if only ports 
135 and 445 could be used for such an exploit. Nearly 
800,000 systems presently accept connections on port 
445 from the internet, according to Akamai researchers' 
analysis of the vulnerability. The true figure is higher 
because this is based on information from the Shodan 
search engine, which has poor exposure. The figure 
increases to nearly 2.1 million when all systems that 
openly promote a "Microsoft RPC Endpoint Mapper" 
service are included.
Why port blocking may not be effective
Even Microsoft cautions that even if communication over port 445 is restricted at the 
network perimeter, "systems could still be exposed to attacks from within their 
business perimeter" in their advisory for this issue. Due to SMB's widespread use in 
business environments, filtering such traffic inside local networks is a problem that is 
considerably more difficult to solve. "Limiting lateral movement by permitting inbound 
TCP port 445 only on computers where it is needed — domain controllers, print 
servers, file servers, etc.," advise the Akamai researchers. For help safeguarding SMB 
Install thtrea ffipact cohn  tWhiantd wowass  rseelrevaesres,d c oonn sAuultg Musictr o1s1o, f2t.020, on your system:
This is what the patch will do:
a. Requires Windows-based device machine accounts to use secure RPC.
b. Requires trust accounts to use secure RPC.
c. Requires all Windows and non-Windows DCs to use secure RPC.
d. Adds a new group policy to permit accounts for non-compliant device types (those that use 
vulnerable Netlogon secure channel connections). Allowed devices won't be denied connection, 
not even while DCs are operating in enforcement mode or after the Enforcement phase has 
begun.
To enable DC enforcement mode for all machine accounts, use the FullSecureChannelProtection 
registry key (enforcement phase will update DCs to DC enforcement mode).
About 
Us
How can the Calcom Hardening Suite significantly improve server 
hardening?
The best option for IT Ops and CISOs wishing to design a securely 
configurable environment is CalCom Hardening Suite (CHS). CHS is a 
versatile instrument for hardening that has the unusual capacity to 
"learn" which hardening adjustments would have a negative effect on 
manufacturing activity. Before baseline modifications are made, CHS 
assesses their effects, providing decision-makers with clear results. In 
order to prevent security breaches and operational errors, CHS 
minimises time-consuming lab testing, lowers the cost and impact of 
hardening, and centres infrastructure control.
Contact 
Us
www.calcomsoftware.co
m
[email protected] +972-8-9152395
East Coast of the U.S.A.
ZIP Code 43900