SCA-2022-0004

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.