CVE-2021-26414

A vendor fix is available.

• FixedSICK MEAC with Windows 10 (20H2, 21H1, 1607, 1809, 1909, 2004 for 32-bit Systems, ARM64-based Systems, x64-based Systems)sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows 7 (for 32-bit Systems Service Pack 1, for x64-based Systems Service Pack 1)sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows 8.1 (for 32-bit systems, for x64-based systems)sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows RT 8.1sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows Server 2004 (Server Core installation)sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows Server 2008 (R2 for x64-based Systems Service Pack 1, R2 for x64-based Systems Service Pack 1,(Server Core installation), for 32-bit Systems Service Pack 2, for 32-bit Systems Service Pack 2 (Server Core installation), for x64-based Systems Service Pack 2, for x64-based Systems Service Pack 2 (Server Core installation))sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows Server 2012 ((GUI), (Server Core installation), R2, R2 (Server Core installation))sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows Server 2016 ((GUI), (Server Core installation))sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows Server 2019 ((GUI), (Server Core installation))sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.

• FixedSICK MEAC with Windows Server 20H2 (Server Core Installation)sick_psirt

  Microsoft is addressing this vulnerability in a phased rollout of Windows security updates. Under the current schedule, the hardening changes can be disabled until March 14, 2023: - June 8, 2021: Hardening changes **disabled by default** but with the ability to enable them using a registry key. - June 14, 2022: Hardening changes **enabled by default** but with the ability to disable them using a registry key. - March 14, 2023: Hardening changes **enabled** by default **with no ability to disable them**. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. Prior to the March 2023 release, the hardening change will be disabled if the registry key HKEY_LOCAL_MACHINE \\ SOFTWARE \\ Microsoft \\ Ole \\ AppCompat \\ RequireIntegrityActivationAuthenticationLevel is undefined or 0, and enabled, if set to 1. A reboot is required after making any changes to the registry key. **Recommended measures:** Given the moderate risk (a user having to deliberately access a malicious server), SICK recommends deactivating the hardening by using the above registry key, until it has been confirmed that the hardening does not adversely affect the MEAC functionality. SICK will then inform customers in an updated version of this security advisory. In a subset of Windows versions with release dates newer than between August 2021 and October 2021, depending on the Windows version, customers can identify vulnerable installations by checking the Windows event log for messages.