Risk: Medium
Microsoft quietly fixed a security weakness in the configuration of the built-in firewall component of Windows XP recently.
The firewall - turned on by default by XP Service Pack 2 (SP2) - can leave files open across the whole net if users choose to enable file and printer sharing, it transpires. Such access should be restricted across a local network but Microsoft has implemented the feature in such a way that, for users of some dial-up ISPs, a local sub-net becomes the whole Internet. Microsoft first informed users of this in September 2004 but it has taken almost three months for it to release a fix.
Configuration changes released through Windows Update during late December 2004 narrowed the scope of what is defined as a local network. The update was issued at the same time as Microsoft's monthly patch roundup but was treated separately by Redmond. Microsoft have defined the update as "critical".
In other Windows security news, security firm Secunia warns of a flaw in IE that can be used to conduct cross-site scripting attacks. The firm has produced a test to illustrate how the unpatched vulnerability might be harnessed in phishing attacks. Even fully patched systems running Windows XP SP2 and up to date versions of IE are potentially vulnerable. Secunia advises users concerned about the problem to deactivate ActiveX or to use an alternative browser.