APPNET0071 - Remoting Services TCP channels must utilize authentication and encryption.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Note: Microsoft recommends using the Windows Communication Framework (WCF) rather than .Net remoting. New development projects should refrain from using .Net remoting capabilities whenever possible.

.NET remoting provides the capability to build widely distributed applications. The application components may reside all on one computer or they may be spread out across the enclave. .NET client applications can make remoting calls to use objects in other processes on the same computer or on any other computer that is reachable over the network. .NET remoting can also be used to communicate with other application domains within the same process. Remoting is achieved via the exposure of endpoints that can be used to establish remote connectivity.

Normally when application code attempts to access a protected resource, a stack walk is performed to ensure that all stack frames have permission to access the resource. However, with .Net 4.0, when a call is made on a remote object, this stack walk is not performed across the remoting boundary. The .Net remoting infrastructure requires FullTrust permission to execute on either the client or the server.

Due to the fact that FullTrust permission is required, Remoting endpoints should be authenticated and encrypted in order to protect the system and the data.

Microsoft provides 3 different 'channels' that are used for remoting. They are HTTP, TCP and IPC.

Any unauthorized use of a remoting application provides unauthorized access with FullTrust permissions to the system. This can potentially result in a loss of system integrity or confidentiality.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Ensure encryption and message integrity are used for TCP remoting channels.

TCP remoting connections are protected via the secure=true configuration parameter.
<channels>
<channel ref='tcp' secure='true' />
</channels>

Include the secure='true' flag in the channel ref parameter of the machine.config and [application name].exe.config file if the [application name].exe.config file exists on the system.

Item Details

Audit Name: DISA STIG for Microsoft Dot Net Framework 4.0 v2r3

Plugin: Windows

Control ID: 615ebb8b2ec3400598d1c1ed2976387235a6f33baf99b847c5e248800695dd82

Detections

Analytics

APPNET0071 - Remoting Services TCP channels must utilize authentication and encryption.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details