Microsoft this week announced the availability of an out-of-band security update for Windows 8.1 and Windows Server 2012 R2 systems to address two elevation of privilege vulnerabilities in Windows Remote Access.
Microsoft this week announced the availability of an out-of-band security update for Windows 8.1 and Windows Server 2012 R2 systems to address two elevation of privilege vulnerabilities in Windows Remote Access.
The two security flaws were detailed on August 11, when Microsoft rolled out the August 2020 updates for its products. At the time, the company patched these issues in Windows 10, Windows 7, and Windows Server 2008, 2012, 2016, 2019, and Windows Server versions 1903, 1909, and 2004.
On August 19, however, the tech giant announced the immediate availability of an out-of-band update that patches the bugs in Windows 8.1 and Windows Server 2012 R2 as well, prompting users to apply the fixes as soon as possible.
Tracked as CVE-2020-1530, the first of the bugs is triggered when Windows Remote Access improperly handles memory. An attacker looking to exploit the flaw would need execution capabilities on the system and needs to run a specially crafted application in order to elevate privileges.
The second vulnerability is tracked as CVE-2020-1537 and is triggered upon Windows Remote Access’ improper handling of file operations. It too requires pre-existing code execution capabilities on the system and for the attacker to run a specially crafted application.
To address the issues, Microsoft corrected the manner in which Windows Remote Access handles memory and ensured that the component properly handles file operations.
“Microsoft is announcing the availability of security update 4578013 for all supported versions of Windows 8.1 and Windows Server 2012 R2. Customers running Windows 8.1 or Server 2012 R2 should install the update for their product to be protected from this vulnerability. Customers running other versions of Microsoft Windows or Windows Server do not need to take any action,” the company announced.
For systems without automatic updates enabled, the patches can be downloaded from the Microsoft Update Catalog website.
Related: Actively Exploited Windows Spoofing Flaw Patched Two Years After Disclosure
Related: Microsoft's Patch for LSASS Flaw Incomplete, Google Researcher Says
Related: Microsoft Patches Actively Exploited Windows, IE Vulnerabilities
Tags: