Microsoft DCOM hardening and its impact on Applications Manager

Microsoft recently acknowledged a critical vulnerability in the WMI connection affecting the DCOM protocol, which allowed attackers to bypass DCOM server security, elevate their privileges, and gain unauthorized access into the systems. Microsoft released a series of security updates (KB5004442) over the last two years, popularly known as DCOM hardening, to overcome the issue, which impacted various third-party applications making use of the DCOM protocol, resulting in authentication and request failures.

This blog explains the vulnerability, discusses the measures taken by Microsoft to overcome the vulnerability, and looks at the impact of these measures on WMI-based applications like ManageEngine Applications Manager.

About the vulnerability

The Windows DCOM Server Security Feature Bypass (CVE-2021-26414) vulnerability allows attackers to elevate their privileges and gain unauthorized access to a system by exploiting the way WMI connections are made through DCOM protocol. The Distributed Component Object Model (DCOM) is a communication protocol used in Windows for communication between the software components of networked devices through remote procedure calls (RPCs), which enables software programs to communicate with other programs and components across a network. This vulnerability enables attackers to exploit the DCOM connection by impersonating a user and elevating their privileges, resulting in a compromised system security.

Windows DCOM hardening: Microsoft’s workaround to address the vulnerability

Microsoft took a phased approach to mitigate the vulnerability by releasing a series of security updates in three phases to prevent breakages in various WMI-based applications. Here is the list of security updates, known as DCOM hardening, that were released by Microsoft:

Impact of DCOM hardening on Applications Manager

Many Windows-based applications rely on WMI connections to communicate with Windows systems. The applications that require these connections are typically built on top of the WMI infrastructure provided by Windows, meaning they can easily be affected by any sort of modifications performed in the underlying WMI infrastructure.

Now that the security updates from Microsoft have hardened the DCOM settings, these changes have an adverse impact on various WMI-based applications, including Applications Manager. Due to these changes, Applications Manager users have experienced authentication failures and request failures while monitoring WMI-based resources, resulting in data collection issues.

The Microsoft DCOM hardening patch

To resolve the impacts caused by Windows DCOM hardening, Microsoft released the Client-side request auto-elevation patch, which automates the process of elevating the authorization levels of client DCOM requests to the DCOM server. The patch ensures that the requests made to establish WMI connections are allowed only from applications that are explicitly authorized to perform such requests, preventing attackers from impersonating a user with elevated privileges through a WMI connection. The patch handles the authorization process automatically, without the need for WMI-based applications to modify their existing code in order to handle the impact.

Here is the list of security updates that were released subsequently as a part of the Windows DCOM hardening patch:

If you have installed the cumulative security updates as of January 2023 on your clients and servers, they will have the latest auto-elevate patch fully enabled.

How the patch helps Applications Manager

Now that the Microsoft DCOM hardening patch handles the authorization process automatically, WMI-based applications like Applications Manager now find it easier to overcome the impact caused by DCOM hardening and helps to reduce compatibility issues. When Applications Manager tries to connect to a remote Windows server, the Applications Manager-installed server acts as the DCOM Client whereas the remote server acts as the DCOM server. As a result, this allows Applications Manager to continue to function normally and ensures that WMI connections are made without the need for manual modifications.

Conclusion

The Windows DCOM hardening updates released by Microsoft created a significant impact on applications that used WMI connections to communicate with the Windows systems. The updates lead to authentication and request failures while monitoring WMI-based resources causing data collection issues in Applications Manager. However, the client-side request auto-elevation patch released by Microsoft serves as a savior by handling the authorization process automatically, allowing dependent applications to function normally.

We highly recommend Applications Manager users apply the patch into your Windows environments to ensure the security and integrity of your systems. Also, make sure to stay up-to-date with the DCOM hardening updates and patches released by Microsoft, and install them as soon as possible to enable advanced protection from latest security threats.