Microsoft rushes out patch for Windows XP to prevent another WannaCry attack via a Shadow Brokers release

Microsoft has, for the second month in a row, released a critical security patch for its out-of-support-but-still-widely-used Windows XP operating system, and warned that another WannaCry-style attack could be coming for organisations (ie: the NHS) that don't take proactive action now. 

Last month, Microsoft was forced to rush out a free patch for Windows XP to help contain the spread of the WannaCry ransomware, which hit at least 75,000 PCs worldwide, and struck NHS hospitals across the UK. Following the release, reports surfaced claiming that Microsoft had been sitting on the patch since February. 

In a bid to prevent a similar scenario, Microsoft yesterday issued emergency updates for legacy versions of Windows dating back to XP, Windows Server 2003, Windows XP Embedded and Windows 7 Embedded. 

The company warned in a blog post that Tuesday's updates include fixes for three new exploits that, like Eternalblue used by WannaCry, were released by the Shadow Brokers hacking group. 

"In reviewing the updates for this month, some vulnerabilities were identified that pose elevated risk of cyber attacks by government organisations, sometimes referred to as nation-state actors or other copycat organisations," said Adrienne Hall, general manager of crisis management at Microsoft. 

"To address this risk, today we are providing additional security updates along with our regular Update Tuesday service. These security updates are being made available to all customers, including those using older versions of Windows." 

Microsoft had previously said that it wouldn't issue out-of-support patches for the three exploits, codenamed EsteemAudit, ExplodingCan, and EnglishmanDentist, which exploit flaws in the Windows remote desktop protocol, IIS 6.0 and Microsoft Exchange servers. 

In the post, Microsoft clarified this doesn't mean a return to full support for Windows XP, which ended in 2014. 

The company clarified this was an exception based on new intelligence and "should not be viewed as a departure from our standard servicing policies". 

The out-of-support updates are included in Microsoft's June Patch Tuesday release, which addressed a whopping 94 vulnerabilities. This includes fixes for 27 remote code execution (RCE) exploits that could enable an attacker to take control of a machine. 

Further reading

Peter Cochrane: WannaCry? I wanna understand what's going on

• Leadership
• 14 Jun 2017

Linguistic analysis of WannaCry ransomware points to native Chinese speakers

• Security
• 26 May 2017

North Korea linked to WannaCry attack, as experts say the NHS should have done more to protect itself

• Hacking
• 16 May 2017

Samba flaw could spread WannaCry-like worm, warns DHS

• Security
• 25 May 2017

Symantec: "Highly likely" North Korea was behind WannaCry global ransomware attacks

• Cloud and Infrastructure
• 23 May 2017

Windows XP so out-of-date it limited WannaCry spread

• Applications
• 19 May 2017

• Tweet  
• Facebook  
• LinkedIn  
• Google plus  
• Send to  

• Topics
• Security
• Microsoft
• Security
• malware
• Windows
• Windows XP
• security
• hacking
• ransomware
• wannacry
• Shadow Brokers