I have found on my machine port 111 is open. This is listed as RPC.
I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open?
How can I secure this port?
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
TCP and UDP ports 111 are the well-known ports for ONC RPC portmapper. Portmapper is analagous to DNS, in that an RPC server registers with the portmapper process on the machine they both run on. An RPC server gives the portmapper the port(s) on which the RPC server listens for requests, and the (hopefully unique) number that identifies the interface or contract that the RPC server provides.
A prospective RPC client queries the portmapper on port 111, giving it the number identifying the RPC server that the RPC client wishes to use. Portmapper gives back the TCP or UDP port(s) that the RPC server registered earlier. The RPC client then can contact the RPC server directly, leaving portmapper out of any further interactions.
If you don't have an ONC RPC server process running, then you probably shouldn't have portmapper running. The most common RPC server would have to be NFS, Sun's Network File System, but NIS and NIS+ also uses that RPC system. Portmapper code had suffered a few buffer overflows, but in general it was pretty rugged. I wouldn't run portmapper without running a server just on general principle: why waste CPU cycles on it, as well as give morons a target to try 25-year old exploits on?
Portmapper can allow an attacker to quickly determine if you run a vulnerable service. However, blocking portmapper isn't really sufficient since they can just call procedure 0 on open ports to find the services.
If you don't need external access to your onc rpc services, don't permit it.