Security News > 2020 > November > Windows 7 and Server 2008 zero-day bug gets a free patch
An unpatched local privilege escalation vulnerability affecting all Windows 7 and Server 2008 R2 devices received a free and temporary fix today through the 0patch platform.
0patch's free micropatch is targeting Windows 7 and Server 2008 R2 computers without ESU and those with ESU. At the moment, only small-and-midsize businesses or organizations with volume-licensing agreements can get an ESU license until January 2023.
The LPE vulnerability stems from the misconfiguration of two service registry keys and it enables local attackers to elevate their privileges on any fully patched Windows 7 and Server 2008 R2 system.
"At this point, if you are still using Windows 7 / Server 2008 R2 without isolating these machines properly in the network first, then preventing an attacker from getting SYSTEM privileges is probably the least of your worries," Labro said.
0patch micropatches are code sent through the 0patch platform to Windows clients to patch security issues in real-time and applied to running processes without requiring a system restart.
News URL
Related news
- Windows Server 2025 previews security updates without restarts (source)
- Microsoft ends development of Windows Server Update Services (WSUS) (source)
- Windows Server 2025 gets hotpatching option, without reboots (source)
- Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released (source)
- Rackspace internal monitoring web servers hit by zero-day (source)
- 'Patch yesterday': Zimbra mail servers under siege through RCE vuln (source)
- Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws (source)
- Microsoft fixes Remote Desktop issues caused by Windows Server update (source)
- Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server (source)
- North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (source)