Important changes affecting the BORA BS client on computers with Windows 7/Windows Server 2008 R2

BORA :: Blog

BORA Solutions

Architecture

Jul132022

Information on changes to Windows DCOM that affect the BORA Business Suite (BORA BS) client installed on computers with Windows 7/Windows Server 2008 R2 and connecting to a BORA BS server (Application Server) installed on a newer version of Windows.

Because of a security issue found in 2021 in communication with DCOM (Distributed Component Object Model, part of Windows that BORA Business Suite also uses), in June 2021 Microsoft released updates for the officially supported versions of Windows. Since the extended support period for Windows 7 / Windows Server 2008 R2 ended on 14.01.2020, they do not receive these updates (except where additional Extended Security Updates (ESU) licences were bought).

The updates add a requirement for more secure communication with the DCOM part of Windows.
Since newer versions of Windows have the DCOM updates installed and computers with Windows 7/Windows Server 2008 R2 do not,the newer versions will not allow communication from computers with the older versions.
In effect, older versions of Windows will be unable to connect to DCOM on a newer version, whichwill prevent a BORA BS client installed on an old version of Windows from connecting to the BORA BS server part installed on a newer version of Windows.

More secure DCOM communication is being switched on in several phases:
- phase 1 (from June 2021): secure communicationis NOT on by default, but can be switched onthrough Windows Registry settings; in this case there is no problem with communication between old and new versions of Windows;
- phase 2 (from June 2022): secure communicationIS on by default, but can be switched off through Windows Registry settings; in this case there will be a problem with communication between old and new versions of Windows,but it can be switched offon the new versions to allow communication;
- phase 3 (from March 2023): secure communicationIS on AND CANNOT be switched off; in this case there will be a problem with communication between old and new versions of Windows.

A symptom of this problem can be seen from June 2022, when the update is on by default: computers with Windows 7 will not be able to connect (so BORA BS will not start), while those with newer versions of Windows will (BORA BS starts successfully).

A temporary solution (until phase 3, March 2023) is to switch off secure communication on the newer versions of Windows through the Registry.
Once phase 3 begins, i.e. from March 2023, communication will no longer work, and a possible solution will be to replace the old Windows version of the client with a newer one, or to reconfigure the installation to use a separate/local BORA BS server installed on an old version of Windows that communicates directly with the SQL Server database.

More information on the update can be found in these articles:

CVE-2021-26414 | Windows DCOM Server Security Feature Bypass

KB5004442, Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)