The remote Windows host is missing security update 4537803 or cumulative update 4537821. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     Windows Remote Desktop Client when a user connects to a     malicious server. An attacker who successfully exploited     this vulnerability could execute arbitrary code on the     computer of the connecting client. An attacker could     then install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2020-0681, CVE-2020-0734, CVE-2020-0817)

  - A memory corruption vulnerability exists when Windows     Media Foundation improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could install programs; view, change, or delete data; or     create new accounts with full user rights. There are     multiple ways an attacker could exploit the     vulnerability, such as by convincing a user to open a     specially crafted document, or by convincing a user to     visit a malicious webpage. The security update addresses     the vulnerability by correcting how Windows Media     Foundation handles objects in memory. (CVE-2020-0738)

  - An information disclosure vulnerability exists in the     way that affected Microsoft browsers handle cross-origin     requests. An attacker who successfully exploited this     vulnerability could determine the origin of all of the     web pages in the affected browser.  (CVE-2020-0706)

  - An information disclosure vulnerability exists in the     Windows Common Log File System (CLFS) driver when it     fails to properly handle objects in memory. An attacker     who successfully exploited this vulnerability could     potentially read data that was not intended to be     disclosed. Note that this vulnerability would not allow     an attacker to execute code or to elevate their user     rights directly, but it could be used to obtain     information that could be used to try to further     compromise the affected system.  (CVE-2020-0658)

  - An elevation of privilege vulnerability exists in the     way that the tapisrv.dll handles objects in memory. An     attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2020-0737)

  - An elevation of privilege vulnerability exists in the     way that the Windows Kernel handles objects in memory.
    An attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2020-0668)

  - A security feature bypass vulnerability exists in secure     boot. An attacker who successfully exploited the     vulnerability can bypass secure boot and load untrusted     software.  (CVE-2020-0689)

  - An information disclosure vulnerability exists in the     Cryptography Next Generation (CNG) service when it fails     to properly handle objects in memory.  (CVE-2020-0675,     CVE-2020-0676, CVE-2020-0677, CVE-2020-0748,     CVE-2020-0755, CVE-2020-0756)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2020-0691)

  - An elevation of privilege vulnerability exists in Active     Directory Forest trusts due to a default setting that     lets an attacker in the trusting forest request     delegation of a TGT for an identity from the trusted     forest.  (CVE-2020-0665)

  - An elevation of privilege vulnerability exists in     Windows Error Reporting (WER) when WER handles and     executes files. The vulnerability could allow elevation     of privilege if an attacker can successfully exploit it.
    An attacker who successfully exploited the vulnerability     could gain greater access to sensitive information and     system functionality.  (CVE-2020-0753, CVE-2020-0754)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2020-0716)

  - A remote code execution vulnerability exists in the way     that Windows handles objects in memory. An attacker who     successfully exploited the vulnerability could execute     arbitrary code with elevated permissions on a target     system.  (CVE-2020-0662)

  - An elevation of privilege vulnerability exists in the     Windows Installer when MSI packages process symbolic     links. An attacker who successfully exploited this     vulnerability could bypass access restrictions to add or     remove files.  (CVE-2020-0683, CVE-2020-0686)

  - A remote code execution vulnerability exists in     Microsoft Windows that could allow remote code execution     if a .LNK file is processed. An attacker who     successfully exploited this vulnerability could gain the     same user rights as the local user.  (CVE-2020-0729)

  - An elevation of privilege vulnerability exists when the     Windows Common Log File System (CLFS) driver improperly     handles objects in memory. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context.  (CVE-2020-0657)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2020-0719, CVE-2020-0720,     CVE-2020-0721, CVE-2020-0722, CVE-2020-0723,     CVE-2020-0724, CVE-2020-0725, CVE-2020-0726,     CVE-2020-0731)

  - An elevation of privilege vulnerability exists when the     Windows User Profile Service (ProfSvc) improperly     handles symlinks. An attacker who successfully exploited     this vulnerability could delete files and folders in an     elevated context.  (CVE-2020-0730)

  - An elevation of privilege vulnerability exists in the     way that the Windows Function Discovery Service handles     objects in memory. An attacker who successfully     exploited the vulnerability could execute code with     elevated permissions.  (CVE-2020-0679, CVE-2020-0680,     CVE-2020-0682)

  - An information disclosure vulnerability exists when the     Windows Network Driver Interface Specification (NDIS)     improperly handles memory.  (CVE-2020-0705)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2020-0660)

  - An information disclosure vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory, allowing an attacker to     retrieve information from a targeted system. By itself,     the information disclosure does not allow arbitrary code     execution; however, it could allow arbitrary code to be     run if the attacker uses it in combination with another     vulnerability.  (CVE-2020-0744)

  - An elevation of privilege vulnerability exists when the     Windows IME improperly handles memory.  (CVE-2020-0707)

  - A remote code execution vulnerability exists in Remote     Desktop Services formerly known as Terminal Services     when an authenticated attacker abuses clipboard     redirection. An attacker who successfully exploited this     vulnerability could execute arbitrary code on the victim     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2020-0655)

  - An elevation of privilege vulnerability exists when     Windows Error Reporting manager improperly handles hard     links. An attacker who successfully exploited this     vulnerability could overwrite a targeted file leading to     an elevated status.  (CVE-2020-0678)

  - An elevation of privilege vulnerability exists in the     way that the Windows Search Indexer handles objects in     memory. An attacker who successfully exploited the     vulnerability could execute code with elevated     permissions.  (CVE-2020-0666, CVE-2020-0667,     CVE-2020-0735, CVE-2020-0752)

  - An information disclosure vulnerability exists when the     Telephony Service improperly discloses the contents of     its memory. An attacker who successfully exploited the     vulnerability could obtain information to further     compromise a users system.  (CVE-2020-0698)

  - An elevation of privilege vulnerability exists when the     Windows Graphics Component improperly handles objects in     memory. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2020-0715, CVE-2020-0745)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2020-0673, CVE-2020-0674)

  - A remote code execution vulnerability exists when the     Windows Imaging Library improperly handles memory.
    (CVE-2020-0708)

  - An elevation of privilege vulnerability exists in the     way that the sysmain.dll handles objects in memory. An     attacker who successfully exploited the vulnerability     could execute code with elevated permissions. To exploit     the vulnerability, a locally authenticated attacker     could run a specially crafted application. The security     update addresses the vulnerability by ensuring the     sysmain.dll properly handles objects in memory.
    (CVE-2020-0818)

Detections

Analytics

KB4537803: Windows 8.1 and Windows Server 2012 R2 February 2020 Security Update

high Nessus Plugin ID 133615

Version 1.14

Version 1.13

Version 1.12

Version 1.14 Jun 17, 2024, 3:35 PM Plugin metadata (add more granular CPEs to Windows OS plugins) Plugin Feed: 202406171535
Version 1.13 Jan 23, 2023, 4:10 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301231610
Version 1.12 Dec 6, 2022, 6:51 PM Reference Plugin Feed: 202212061851