Critical XP SP2 Update Fixes Windows Firewall Bug

Microsoft Corp. has quietly released a "critical" Windows XP Service Pack 2 update to fix a serious flaw in the Windows Firewall utility.

"After you set up Microsoft Windows Firewall in Microsoft Windows XP Service Pack 2 (SP2), you may discover that your computer can be accessed by anyone on the Internet when you use a dial-up connection to connect to the Internet," the company said in a knowledge base article.

The update was not included—or mentioned—in the five "important" advisories Microsoft released earlier this week. Two of those bulletins applied to XP SP2, but the severity rating was reduced to "moderate" for those customers.

Gary Schare, director of Windows product management at Microsoft, said it was "an unfortunate oversight" that the SP2 update was shipped without notice.

Asked directly why the update was not included with the five patches released on the same day, Schare told eWEEK.com that the timing of the update release was merely coincidental.

Schare described the firewall fix as a "configuration issue," which meant that it was not treated as a software vulnerability. "There are a small bucket of things that go out as critical updates, but theyre not vulnerability-related. This was one of those," he said.

He said the bug was first reported back in September and Microsoft provided public guidance to help users understand the risk. "We will update that guidance to reflect the fact that the update has shipped."

According to the Microsoft article, the Windows Firewall bug affects Windows XP Home Edition SP2, Windows XP SP2, Windows XP Tablet PC Edition 2005 and Windows XP Media Center Edition SP2.

Since releasing XP SP2 as a security-focused makeover of the Windows operating system, Microsoft has released five bulletins, two with "critical" ratings.

Click here to read about how a private research firms warnings about flaws in SP2 sparked a debate over responsible disclosure.

The latest bug, which only affects users with dial-up Internet connections, occurs because of the way that Windows Firewall interprets local subnets when the "My network (subnet) only" option is used.

Because of the way that some dialing software configures routing tables, Microsoft said the firewall sometimes interprets the whole Internet to be a local subnet. "This can let anyone on the Internet access the Windows Firewall exceptions," the company warned in the article.

According to the notice, when the "My network (subnet) only" option is enabled, it is automatically selected for file and print sharing, leaving shared drives wide open when a dial-up connection is used.

Editors Note: This story was updated to include information and comments from Microsoft.

Check out eWEEK.coms for Microsoft and Windows news, views and analysis.