'Critical' XP SP2 Update Fixes Windows Firewall Bug

Microsoft Corp. has quietly released a "critical" Windows XP Service Pack 2 update to fix a serious flaw in the Windows Firewall utility.

"After you set up Microsoft Windows Firewall in Microsoft Windows XP Service Pack 2 (SP2), you may discover that your computer can be accessed by anyone on the Internet when you use a dial-up connection to connect to the Internet," the company said in a knowledge base article.

The update was not included—or mentioned—in the five "important" advisories Microsoft released earlier this week. Two of those bulletins applied to XP SP2, but the severity rating was reduced to "moderate" for those customers.

Microsoft officials could not be reached to discuss why the SP2 update was left out of the scheduled monthly advisories.

According to the article, the Windows Firewall bug affects Windows XP Home Edition SP2, Windows XP SP2, Windows XP Tablet PC Edition 2005 and Windows XP Media Center Edition SP2.

Since releasing XP SP2 as a security-focused makeover of the Windows operating system, Microsoft has released five bulletins, two with "critical" ratings.

Click here to read about how a private research firm's warnings about flaws in SP2 sparked a debate over responsible disclosure.

The latest bug, which only affects users with dial-up Internet connections, occurs because of the way that Windows Firewall interprets local subnets when the "My network (subnet) only" option is used.

Because of the way that some dialing software configures routing tables, Microsoft said the firewall sometimes interprets the whole Internet to be a local subnet. "This can let anyone on the Internet access the Windows Firewall exceptions," the company warned in the article.

According to the notice, when the "My network (subnet) only" option is enabled, it is automatically selected for file and print sharing, leaving shared drives wide open when a dial-up connection is used.

Check out eWEEK.com's for Microsoft and Windows news, views and analysis.