Microsoft patches expired Windows XP again as fresh exploits emerge

Redmond updates old OS to respond to Shadow Brokers' latest leak

Microsoft has taken the extraordinary step of pushing out an emergency patch for its outdated Windows XP operating system for the second time in a matter of weeks, this time following the release of a host of NSA exploits.

As part of June's Patch Tuesday, the company took the unusual step of issuing more fixes for XP, which went out of support in 2014, in anticipation of more WannaCry-style attacks against the platform - it patched XP'sWannaCryvulnerability some weeks ago.

TheShadow Brokers groupreleased the three exploits that prompted Microsoft to patch its ancient OS. The flaws areconsidered to pose an "elevated risk of cyber attacks by government organisations", Microsoft warned in ablog post.

"Due to the elevated risk for destructive cyber attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt," said Adrienne Hall, general manager for Microsoft's cyber defence operations centre.

Microsoft received criticism for its response to the WannaCry ransomware attack, as Windows XP, which still retains almost 6% of theoperating system market share, was patched much later than Windows 7, 8.1 and 10. Microsoft has said that the latest security patch will be available to all users, including those running outdated operating systems.

Thethree exploits, known as "EnglishmanDentist", "EsteemAudit" and "ExplodingCan" are all classed as remote execution vulnerabilities, allowing hackers to gain access with full user rights. EsteemAudit (CVE-2017-0176) exploits a flaw in the Windows remote code execution protocol, while EnglishmanDentist allows the execution of malware through Windows OLE.

This update is in addition to the regular Patch Tuesday, and while those with automatic updates enabled on Windows 7 or later will receive the patches immediately, those on older systems such as Windows Vista and XP will need to manually update their systems through the Microsoft Download Centre.

"Our decision today to release these security updates for platforms not in extended support should not be viewed as a departure from our standard servicing policies," said Eric Doerr, general manager at Microsoft's security response centre. "Based on an assessment of the current threat landscape by our security engineers, we made the decision to make updates available more broadly."

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

New FamousSparrow hacking group caught targeting hotels
vulnerability

New FamousSparrow hacking group caught targeting hotels

24 Sep 2021
Microsoft unveils new Surface Pro, Go, Duo and Studio devices
Laptops

Microsoft unveils new Surface Pro, Go, Duo and Studio devices

22 Sep 2021
Bug fixes and app updates arrive with latest Windows 11 preview build
Microsoft Windows

Bug fixes and app updates arrive with latest Windows 11 preview build

17 Sep 2021
Podcast transcript: Are foldable phones more than a fad?
Mobile

Podcast transcript: Are foldable phones more than a fad?

17 Sep 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021