Question Plesk says: "Your Windows Servers are at risk" - are they?

[burnley]

Received last night an email from Plesk with the following content:

Microsoft Windows Server Critical Vulnerability

There's a critical vulnerability in Microsoft Windows Server's default configuration. If your server is compromised, this can be used to obtain Administrator privileges.

Even though this vulnerability isn't in Plesk, we're invested in your server's safety. And so, as a temporary workaround, we recommend you disable DCOM support on the server. Alternatively, Microsoft official recommendations state that using Windows Server 2019 would mitigate this attack vector.

You can find full details and our recommendation on this issue in our dedicated Plesk Knowledge Base article below.

If you run into any issues with Plesk in this context, please contact our support team and use "PFSI-61569" to ensure we handle your request efficiently.

Stay safe,

The Plesk Security Team

Didn't look like phishing to me Can you please quote the original advisory for this DCOM vulnerability?

 

[igor.A.]

Unfortunately, Microsoft does not provide hardening recommendations for the issue due to architectural implementation in operating systems. Their official recommendation is "Using Windows Server 2019 would mitigate this attack vector".

 

[jonium]

is disabling DCOM safe?
Are any webservices depndents by it? ASP ? ASP.NET ?

 

[igor.A.]

DCOM directly is not used by Plesk itself and we have tested main Plesk scenarios with applied changes.
However, it may be used by hosted websites, and this action may somehow affect its functionality.
ASP, ASP.NET as well. Of course, it depends on the code and used components.
Disabling DCOM may also affect environments located in the Windows Domain.

 

[jonium]

the question is:
if I disable it from the registry and restart, if any service will not work may I simple re-enable it from Registry the same way?
I seem to remember that some years ago I had an issue with dcom caused by a disallignement of dcom password and tha account ASP.NET or something similar...

 

[burnley]

Unfortunately, Microsoft does not provide hardening recommendations for the issue due to architectural implementation in operating systems. Their official recommendation is "Using Windows Server 2019 would mitigate this attack vector".

Thanks Igor. Still, where is the specific security advisory, can you give us a link?

 

[igor.A.]

the question is:
if I disable it from the registry and restart, if any service will not work may I simple re-enable it from Registry the same way?
I seem to remember that some years ago I had an issue with dcom caused by a disallignement of dcom password and tha account ASP.NET or something similar...

In general, there should be no issue if you re-enable it from registry.
At least, we haven’t faced with such issues.

 

[igor.A.]

Thanks Igor. Still, where is the specific security advisory, can you give us a link?

There is no Security Advisory provided by Microsoft. You can contact MS support for the question.