|
A.
|
Methods to prevent your machines from rebooting are listed below. Start with the first method and, if that doesn’t work or is inappropriate, try the next method. If none of the methods listed work on your systems, please contact Product Support Services.
For Windows XP or Windows Server 2003, turn on Internet Connection Firewall.
If you are using the Internet Connection Firewall in Windows XP or Windows Server 2003 to protect your Internet connection, it will by default block inbound RPC traffic from the Internet. (See https://support.microsoft.com/default.aspx?scid=kb;en-us;283673&sd=tech.)
To enable the Internet Connection Firewall:
- From the Start menu, run the Control Panel, click Networking and Internet Connections, and click Network Connections.
- Right-click the connection on which you would like to enable the firewall and click Properties. (The connection you choose should be the one that you use to get access to the Internet.)
- On the Advanced tab, select the option to Protect my computer or network.
-
Note: These steps enable the firewall on systems running Windows XP or Windows Server 2003 only. If you are running Windows 2000 or Windows NT 4.0, you should enable a third-party firewall product.
|
<p>
<strong>To disable DCOM on all affected machines:</strong>
</p>
<p>Disabling the DCOM should only be viewed as a temporary measure. If the first method above was already implemented, you should not have to proceed with the method described in this section.<br /><strong>Note</strong> This procedure will not block the exploit on Windows 2000 RTM, SP1, or SP2 systems. It should not be implemented as a workaround on those systems.</p>
<p>When a computer is part of a network, the DCOM protocol enables COM objects on that computer to communicate with COM objects on other computers. You can disable DCOM for a particular computer to help protect against the Blaster vulnerability, but doing so will disable all communication between objects on that computer and objects on other computers.</p>
<p>If you disable DCOM on a remote computer, you will not be able to remotely access that computer afterward to re-enable DCOM. To re-enable DCOM, you will need physical access to that computer.</p>
<p>
<strong>To manually disable (or enable) DCOM for a computer:</strong>
</p>
<table border="0" cellpadding="0" cellspacing="0">
<tr valign="top">
<td>
<ol>
<li>
<p>Run Dcomcnfg.exe.<br />If you are running Windows XP or Windows Server 2003, perform these additional steps:</p>
</li>
<li>
<p>Click <strong>Component Services</strong> under Console Root.</p>
</li>
<li>
<p>Open the <strong>Computers</strong> folder.</p>
<ul>
<li>For the local computer, right-click <strong>My Computer</strong> and choose <strong>Properties</strong>.</li>
<li>For a remote computer, right-click the <strong>Computers</strong> folder, select <strong>New</strong>, select <strong>Computer</strong>, type the computer name, right-click the computer name, and select <strong>Properties</strong>.</li>
</ul>
</li>
<li>Choose the <strong>Default Properties</strong> tab .</li>
<li>Clear (or select) the <strong>Enable Distributed COM on this Computer</strong> check box </li>
<li>If you will be setting more properties for the machine, click the <strong>Apply</strong> button to disable (or enable) DCOM. Otherwise, click OK to apply the changes and exit Dcomcnfg.exe .</li>
<li>
<p>Reboot or restart the system to make the changes take effect.</p>
<p>Although these steps will stop a machine infected or under attack from Blaster from rebooting every few minutes, they should be considered temporary measures because they only help block paths of attack but do not correct the underlying vulnerability.</p>
<p>Additional information on disabling DCOM can be found in this Knowledge Base article 825750, "How to Disable DCOM Support in Windows," <a runat="server" href="https://support.microsoft.com/default.aspx?scid=kb;en-us;825750&sd=tech">https://support.microsoft.com/default.aspx?scid=kb;en-us;825750&sd=tech</a></p>
</li>
</ol>
</td>
</tr>
</table>
<p>If you are running Windows 2000 RTM, SP1, or SP2 and are therefore unable to disable DCOM, you can configure Advanced TCP/IP Filtering.</p>
<p>
<strong>To configure TCP/IP security on Windows 2000:</strong>
</p>
<p>On Windows 2000 systems, where Internet Connection Firewall (ICF) is not available and DCOM cannot be disabled, the following steps will help block the affected ports so that the system can be patched. These steps are based on a modified excerpt from Knowledge Base article 309798, "HOW TO: Configure TCP/IP Filtering in Windows 2000," <a runat="server" href="https://support.microsoft.com/default.aspx?scid=kb;en-us;309798&sd=tech">https://support.microsoft.com/default.aspx?scid=kb;en-us;309798&sd=tech</a>.</p>
<table border="0" cellpadding="0" cellspacing="0">
<tr valign="top">
<td>
<ol>
<li>From the <strong>Start</strong> menu, select <strong>Control Panel</strong>, and select <strong>Network and Dial-up Connections</strong>.</li>
<li>
<p>Right-click the interface you use to access the Internet and click Properties.</p>
</li>
<li>
<p>In the <strong>"Components checked are used by this connection"</strong> box, click <strong>Internet Protocol (TCP/IP)</strong> and click <strong>Properties</strong>.</p>
</li>
<li>
<p>In the <strong>Internet Protocol (TCP/IP) Properties</strong> dialog box, click <strong>Advanced</strong>.</p>
</li>
<li>
<p>Click the <strong>Options</strong> tab.</p>
</li>
<li>
<p>Click <strong>TCP/IP filtering</strong> and click <strong>Properties</strong>.</p>
</li>
<li>
<p>Select the <strong>Enable TCP/IP Filtering (All adapters)</strong> check box.</p>
</li>
<li>
<p>Select the <strong>Permit Only</strong> option in each of the columns with the following labels:</p>
<p>
<strong>TCP Ports</strong>
</p>
<p>
<strong>UDP Ports</strong>
</p>
<p>
<strong>IP Protocols</strong>
</p>
</li>
<li>
<p>Click <strong>OK</strong>.</p>
</li>
</ol>
</td>
</tr>
</table>
<p>
<strong>Note:</strong> Because the TCP/IP filtering enabled above can break many applications (including FTP, P2P software, and Instant Messaging), the TCP/IP filtering should be disabled after the patch is installed.</p>
</td>
|
.gif "Top of page"){kind=icon}
Top of page