More Windows XP fixes in June Patch Tuesday release

Microsoft's June 2017 Patch Tuesday targeted 94 vulnerabilities, and for the second straight month, it included Windows XP fixes and patches for other unsupported systems in order to remediate flaws that could be exploited by leaked National Security Agency cyberweapons.

Security Advisory 4025685 details additional guidance for critical security updates "that are at heightened risk of exploitation due to past and threatened nation-state attacks and disclosures," according to Microsoft. The advisory lists 14 critical and one important bulletin for various products, all but one of which could lead to remote code execution (RCE) exploits.

Also included in this advisory are three patches for legacy systems to protect against leaked NSA cyberweapons. There are two Windows XP fixes to mitigate the threat of EsteemAudit (CVE-2017-0176) and EnglishmanDentist (CVE-2017-8487), which are RCE exploits for Windows Remote Desktop Protocol and Object Linking and Embedding, respectively. Additionally, Microsoft patched the Internet Information Services web server, which was vulnerable to the ExplodingCan exploit (CVE-2017-7269).

Microsoft noted that these legacy system and Windows XP fixes must be manually downloaded.

Eric Doerr, general manager for Microsoft's Security Response Center, recommended users download and apply the critical Windows XP fixes.

"Our decision today to release these security updates for platforms not in extended support should not be viewed as a departure from our standard servicing policies," Doerr wrote in a blog post. "Based on an assessment of the current threat landscape by our security engineers, we made the decision to make updates available more broadly. As always, we recommend customers upgrade to the latest platforms."

Craig Young, principal security researcher at Tripwire Inc., based in Portland, Ore., said the most interesting news of June Patch Tuesday was the release of these Windows Server 2003 and Windows XP fixes.

"Anyone still using Windows 2003 or XP should install these patches ASAP, with the expectation that they will be actively exploited in the near term. This move may indicate that Microsoft has been made aware of exploits that may be pending imminent release from the Shadow Brokers," Young told SearchSecurity. "It is important for admins to recognize that WannaCry was orders of magnitude smaller than some successful malware campaigns of the past like those propagating using the LNK zero-day vulnerabilities exposed along with Stuxnet. We may not be so lucky the next time this happens."