Connect with us

Hi, what are you looking for?



Out-of-Band Update Patches Privilege Escalation Flaws in Windows 8.1, Server 2012

Microsoft this week announced the availability of an out-of-band security update for Windows 8.1 and Windows Server 2012 R2 systems to address two elevation of privilege vulnerabilities in Windows Remote Access.

Microsoft this week announced the availability of an out-of-band security update for Windows 8.1 and Windows Server 2012 R2 systems to address two elevation of privilege vulnerabilities in Windows Remote Access.

The two security flaws were detailed on August 11, when Microsoft rolled out the August 2020 updates for its products. At the time, the company patched these issues in Windows 10, Windows 7, and Windows Server 2008, 2012, 2016, 2019, and Windows Server versions 1903, 1909, and 2004.

On August 19, however, the tech giant announced the immediate availability of an out-of-band update that patches the bugs in Windows 8.1 and Windows Server 2012 R2 as well, prompting users to apply the fixes as soon as possible.

Tracked as CVE-2020-1530, the first of the bugs is triggered when Windows Remote Access improperly handles memory. An attacker looking to exploit the flaw would need execution capabilities on the system and needs to run a specially crafted application in order to elevate privileges.

The second vulnerability is tracked as CVE-2020-1537 and is triggered upon Windows Remote Access’ improper handling of file operations. It too requires pre-existing code execution capabilities on the system and for the attacker to run a specially crafted application.

To address the issues, Microsoft corrected the manner in which Windows Remote Access handles memory and ensured that the component properly handles file operations.

“Microsoft is announcing the availability of security update 4578013 for all supported versions of Windows 8.1 and Windows Server 2012 R2. Customers running Windows 8.1 or Server 2012 R2 should install the update for their product to be protected from this vulnerability. Customers running other versions of Microsoft Windows or Windows Server do not need to take any action,” the company announced.

Advertisement. Scroll to continue reading.

For systems without automatic updates enabled, the patches can be downloaded from the Microsoft Update Catalog website.

Related: Actively Exploited Windows Spoofing Flaw Patched Two Years After Disclosure

Related: Microsoft’s Patch for LSASS Flaw Incomplete, Google Researcher Says

Related: Microsoft Patches Actively Exploited Windows, IE Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.