CVE-2021-26414: Windows DCOM Server Security Feature Bypass

Overview

Severity

Medium (CVSS 4.8)

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2021-Jun

Released

2021-06-08

Last Updated

2023-04-25

EPSS Score

7.17% (percentile: 91.6%)

FAQ

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message. Do I need to take further steps to be protected from this vulnerability? Yes. The security updates released on June 8, 2021 enable RPC_C_AUTHN_LEVEL_PKT_INTEGRITY on DCOM clients by default and provide full protection after manually setting RequireIntegrityActivationAuthenticationLevel = 1 on DCOM servers using the steps in Managing changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414). Note that a reboot is required after making any changes to the RequireIntegrityActivationAuthenticationLevel registry key. Microsoft recommends enabling full protection as soon as possible to identify any OS and application intermobility issues between Windows and non-Windows operating systems and applications. With the June 14, 2022 security updates, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY on DCOM servers is now enabled by default. Customer who need to do so can still disable it by using the RequireIntegrityActivationAuthenticationLevel registry key. If I install the updates and take no further action, what will be the impact? Installing the security updates released on June 8, 2021 enables client side protections in a pure Windows environment but does not provide any protection in environments with non-Windows DCOM client. Organizations will need to identify and mitigate any interop issues between Windows and non-Windows operating systems and applications before the third phase, when the hardening on DCOM servers is enabled by default and will no longer h

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 1 repositories

Affected Products (41)

Windows

• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for 32-bit Systems
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows Server 2016
• Windows Server 2016 (Server Core installation)
• Windows 8.1 for 32-bit systems
• Windows 8.1 for x64-based systems
• Windows RT 8.1

ESU

• Windows 7 for 32-bit Systems Service Pack 1
• Windows 7 for x64-based Systems Service Pack 1
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)

Security Updates (20)

• 5023702
• 5014701
• 5014699
• 5023705
• 5023696
• 5023698
• 5023787
• 5023697
• 5014748
• 5014742
• 5014738
• 5014746
• 5023755
• 5023754
• 5023769
• 5023759
• 5023756
• 5023752
• 5023765
• 5023764

Acknowledgments

Dlive (https://twitter.com/D1iv3) of Tencent Security Xuanwu Lab

Revision History

• 2021-06-08: Information published.
• 2021-11-03: Updated FAQ with revised planned dates for phases two and three; added FAQ to provide link to information about system events. These are informational changes only.
• 2022-01-26: Updated FAQs as follows: Revised planned dates for phases two and three; Added recommendation to install September 2021 security updates to enable DCOM event logs that were added with those updates. These are informational changes only.
• 2022-02-24: Updated FAQs with revised planned dates for phases two and three. This is an informational change only.
• 2022-06-14: Microsoft is announcing the release of the June 14, 2022 Windows security updates to address the second phase of hardening changes for this vulnerability. After these updates are installed, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY on DCOM servers will be enabled by default. Customers who need to do so can still disable it by using the RequireIntegrityActivationAuthenticationLevel registry key. Microsoft strongly recommends that customers install the June 14, 2022 updates, complete testing in your environment, and enable these hardening changes as soon as possible.
• 2022-06-20: Updated FAQ information. This is an informational change only.
• 2022-06-28: In the Security Updates table, added all supported editions of Windows 10 version 21H2, Windows Windows 11, and Windows Server 2022 as they are affected by this vulnerability. Customers running any of these versions of Windows should install the June 14, 2022 security updates to be protected from this vulnerability. After these updates are installed, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY on DCOM servers will be enabled by default. Customers who need to do so can still disable it by using the RequireIntegrityActivationAuthenticationLevel registry key. Microsoft strongly recommends that customers install the updates, complete testing in your environment, and enable these hardening changes as soon as possible.
• 2022-09-15: Fixed a typographical error. This is an information change only.
• 2023-03-14: Microsoft is announcing the release of the March 14, 2023 Windows security updates for all supported editions. These updates address the third phase of hardening changes for this vulnerability. After these updates are installed, hardening is enabled by default and customers will no longer have the ability to disable it. Microsoft strongly recommends that customers install the March 14, 2023 updates, but before doing so customers should resolve any compatibility issues with the hardening changes and applications in your environment. For more information see Managing changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414).
• 2023-04-25: Updated links to security updates. This is an informational change only.