Title

A Windows system has an incorrect default DCOM authorization level. (Cat II impact)

Discussion

The DCOM default authentication level has been detected to be below the required setting. If the authentication level is None, then any user can access any object on the system without authentication.

Check Content

Open a command prompt. Execute “Dcomcnfg.exe”. In the “Component Services” window, navigate to Component Services -> Computer -> My Computer Right-click “My Computer” and select “Properties”. Select the “Default Properties” tab. If the “Default Authentication Level” is set to “None” or “Call”, this is a finding.

Fix Text

Fortify DCOMs default permissions. This should be thoroughly tested to verify DCOM objects continue to function under tightened security. Open a command prompt. Execute “Dcomcnfg.exe”. In the “Component Services” window, navigate to Component Services -> Computer -> My Computer Right-click “My Computer” and select “Properties”. Select the “Default Properties” tab. Select a “Default Authentication Level” other than “None” or “Call”. For sensitive systems, an authentication level of “Packet Privacy” is recommended. Click OK.

Additional Identifiers

Rule ID: SV-29736r2_rule

Vulnerability ID: V-6825

Group Title: DCOM - Default Authorization Level

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.