Kepware DCOM Support Assistant

Owned by Bill Kapusta
Last updated: Jul 13, 2022 by James Bailey (Unlicensed)
3 min read

The following information below was provided by Kepware.

Request

Cannot find any info on Microsoft DCOM Hardening effects on Kepware and OPC DA. Are there patches or recommended mitigation?

Document - CS350729

"Unable to establish OPC DA communication after installing Microsoft DCOM Hardening patches (CVE-2021-26414) with PTC Kepware Products" Modified: 07-Jun-2022

Applies To

  • KEPServerEX 5.20.396.0 to 6.11.718.0

  • ThingWorx Kepware Server 8.0 to 6.11.718.0

Description

  • Will Microsoft's phased rollout of tightened DCOM security impact KEPServerEX?

  • Effect of the Microsoft DCOM update on KEPServerEX communications

  • Will the DCOM updates impact OPC UA/DA connections or any other protocols?

Cause

This notice informs you of a potential anomaly that exists with PTC - Kepware® products that will be unable to establish proper DCOM connection after installing Microsoft® DCOM Hardening patch to address CVE-2021-26414 as described in MS KB5004442 - Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414).

Microsoft is releasing multiple Windows cumulative updates to address CVE-2021-26414. CVE-2021-26414 lists the individual patches. The Microsoft patches address a vulnerability in DCOM. The Microsoft patches increase the minimum authentication level used when establishing DCOM connections. The affected Kepware® products use OPC-DA or are using Windows® APIs to establish DCOM connections between two computers.

Classic OPC-DA utilizes DCOM communications to pass information between workstations. Kepware connectivity applications include an OPC-DA client interface that enables many of them to exchange data with third-party OPC-DA servers. Similarly, KEPServerEX, ThingWorx Kepware Server, OPC Aggregator and LinkMaster function as an OPC-DA server. The DCOM authentication level elevation impacts all OPC-DA communications from these products and any third-party OPC-DA clients and servers running on different workstations (Note OPC-DA communication within one workstation or OPC UA communication are not affected).

Resolution

General Information:

  • OPC-DA Clients and Servers must utilize the same DCOM authentication level. Once the Kepware software DCOM authentication level is changed, the DCOM authentication level used by third-party clients and servers on remote workstations must also be updated.

Temporary Workaround:

  • Following application of Microsoft’s June 14, 2022 Windows cumulative update, customers may use the temporary workaround Microsoft describes in MS KB5004442 to disable the Microsoft DCOM Hardening patch.

  • Important: This mitigation can only be employed until Microsoft releases the final patch update to address CVE-2021-26414 on March 14, 2023. After deploying Microsoft’s final update on or after March 14, 2023, it will no longer be possible to disable Microsoft’s DCOM Hardening patch. After deploying Microsoft’s March 14, 2023 update, the only mitigation available is to reconfigure DCOM appropriately to establish communication to affected products.

  • For Classic OPC-DA communications consider moving clients and servers to operate on the same workstation or migrate the system to replace Classic OPC-DA with OPC UA.

Resolution:

  • Kepware products can be set to use the newly required (by Microsoft) DCOM security with the Windows DCOM configuration utility (DCOMCNFG.EXE). No patch is required

    • The DCOM Authentication Level will need to be set to Packet Level Integrity for both the Client and the Server

      • For Server applications this change will need to be made at the Application level:

 

  • For Client applications this change will need to be made at the My Computer level:

 

  • Note: KEPServerEX may be the Client, Server or both

  • In addition to DCOM configuration, the following product settings must be enabled:

    • KEPServerEX; ThingWorx Kepware Server; OPC Aggregator:

      • Settings>Runtime Options> Use DCOM configuration settings

    • OPC Quick Client:

      • Tools>Options>Use DCOM for remote security

    • LinkMaster:

      • Tools>Options>Runtime Options>Use DCOM configuration utility settings

  • Kepware's Remote OPC DA (DCOM) Configuration Guide has been updated to include the above settings

Other resolution options:

  • Move OPC-DA clients and servers to the same workstation

  • Migrate the system to replace Classic OPC-DA with OPC UA

Related Articles from Kepware

 impact from Microsoft DCOM enhanced security(KB5004442)

 Windows DCOM server security feature bypass impact on PTC ThingWorx Products

 

AutomaTech Inc.