CVE-2019-9514

Обходное решение

The following workaround may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave this workaround in place:

Disable the HTTP/2 protocol on your web server by using the Registry Editor

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

1. Click Start, click Run, type Regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey:

   HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

3. Set DWORD type values EnableHttp2TIs and EnableHttp2Cleartext to one of the following:
   • Set to 0 to disable HTTP/2
   • Set to 1 to enable HTTP/2
4. Exit Registry Editor.
5. Restart the computer.

FAQ

After I install the HTTP/2 updates, is there anything else I need to do to be protected from this vulnerability?

Yes. The update adds configuration settings to the IIS server, but these settings are turned off by default. To be fully protected from the vulnerabilities, an administrator needs to configure their server to limit the number of HTTP/2 packets accepted. This can vary based on the environment and services running on each server.

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

Connection-specific setting

1. Click Start, click Run, type Regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
3. Set DWORD type value Http2MaxPingsPerMinute:
   • Range between 0 and 0xFF
   • This sets the maximum number of pings per minute a client can send to the server
4. Exit Registry Editor.
5. Restart the computer.

Stream-specific settings

1. Click Start, click Run, type Regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
3. Set DWORD type values for any of the following keys:
   • Http2MaxServerResetsPerMinute
     • Range between 0 and 0xFFFF
     • This sets the maximum number of requests per minute from a client that can generate server reset frames
   • Http2MaxPrioritiesPerStream
     • Range between 0 and 0xFF
     • This sets the maximum number of priority frames per minute a client can send to the server
   • Http2MaxResetsPerStream
     • Range between 0 and 0xFF
     • This sets the maximum number of reset frames per minute a client can send to the server
   • Http2MaxUnknownsPerStream
     • Range between 0 and 0xFF
     • This sets the maximum number of unknown frames per minute a client can send to the server
   • Http2MaxWindowUpdatesPerSend
     • Range between 0 and 0xFF
     • This sets the maximum number of window update frames per minute a client can send to the server
   • Http2MinimumSendWindowSize
     • Range between 0 and 0xFFFF
     • This sets the minimum send window size for data frames
4. Exit Registry Editor.
5. Restart the computer.