CVE-2020-1464
Microsoft Windows Spoofing Vulnerability
Description
CVE-2020-1464 is a high-severity spoofing vulnerability in Microsoft Windows that allows attackers to bypass security features by exploiting improper file signature validation. Windows fails to correctly validate file signatures, enabling an attacker to load improperly signed files that would normally be blocked. This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 12.64% (93.9th percentile), the probability of exploitation is significant, making prompt patching essential for all affected Windows systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 10 2004 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 1909 | - |
| microsoft | windows server 2004 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html(Third Party Advisory)
- https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/(Issue Tracking, Third Party Advisory)
- https://medium.com/%40TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd(Exploit, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1464(US Government Resource)
Weakness Type
CWE-347: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature occurs when software does not properly verify that data has been digitally signed by a trusted source. In the case of CVE-2020-1464, Microsoft Windows fails to correctly validate file signatures, allowing attackers to bypass security mechanisms designed to ensure only properly signed files are loaded.
Learn more: CWE-347 — Improper Verification of Cryptographic Signature
Impact Analysis
CVE-2020-1464 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious local exploitation risk. The vulnerability requires local access to exploit but has low attack complexity and only requires low-level privileges, with no user interaction needed. Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected system, allowing attackers to load malicious code disguised as legitimately signed files. The EPSS score of 12.64% (93.9th percentile) indicates a strong probability of active exploitation. Organizations running unpatched Windows systems face the risk of malware execution through improperly signed files that bypass Windows security controls.
Exploit Maturity
CVE-2020-1464 is confirmed as actively exploited, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for this vulnerability via Medium, where the technique known as "GlueBall" is documented in detail. The EPSS score of 12.64% indicates a high probability of exploitation activity. Notably, this vulnerability was reportedly known for over two years before Microsoft released a fix, and the technique of appending malicious JAR files to legitimately signed Windows files was documented by VirusTotal as early as 2019.
Remediation
- Apply vendor security updates immediately as directed by the CISA KEV catalog: Apply updates per vendor instructions. Install the August 2020 Patch Tuesday updates from Microsoft.
- Verify that all Windows systems across the environment have received the security update that corrects how Windows validates file signatures.
- Implement application whitelisting and code signing enforcement policies to add an additional layer of defense against improperly signed executables.
- Monitor endpoints for suspicious file execution patterns, particularly JAR files appended to signed Windows executables, and review logs for anomalous file loading behavior.
- Implement file integrity monitoring to detect unauthorized modifications to signed binaries and enforce strict software restriction policies to limit execution of untrusted code.
Technical Details
CVE-2020-1464 exists because Microsoft Windows does not properly validate file signatures, specifically failing to detect when additional data is appended to a legitimately signed file. The attack vector is local (CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs local access or must deliver a crafted file to the target. The core issue relates to CWE-347 (Improper Verification of Cryptographic Signature) — Windows Authenticode signature verification does not account for extraneous data appended after the signed content, allowing attackers to append malicious Java Archive (JAR) files to legitimately signed Windows PE files. Because Java's JAR loader reads from the end of the file, the appended malicious code executes while the file still appears validly signed to Windows.
Frequently Asked Questions
Is CVE-2020-1464 being actively exploited?
Yes. CVE-2020-1464 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 12.64% (93.9th percentile) further demonstrates a strong probability of exploitation. The technique was exploited before the patch was released.
What products are affected by CVE-2020-1464?
CVE-2020-1464 affects Microsoft Windows. Multiple versions of the Windows operating system are vulnerable where file signature validation is improperly implemented. Organizations should consult the Microsoft Security Advisory for their specific Windows version.
How do I fix CVE-2020-1464?
Apply the August 2020 security update from Microsoft per vendor instructions. Ensure all Windows endpoints have received the patch that corrects file signature validation. Additionally, implement application whitelisting and file integrity monitoring as defense-in-depth measures.
How severe is CVE-2020-1464?
CVE-2020-1464 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, the low attack complexity and ability to fully compromise confidentiality, integrity, and availability make it a serious threat. The high EPSS percentile (93.9th) indicates significant exploitation activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.