XP Service Pack said to fix major flaw

Microsoft Corp. always urges users to update programs when it ships a Service Pack, but an easily exploited Windows XP flaw makes it especially important that users of the operating system download and install the newly released SP1 promptly, several security experts warn.

The Win XP flaw is described as a still little-known but critical vulnerability, and is described as "trivially easy" to exploit by some who have studied it. It could allow files on any PC running Windows XP to be deleted simply by clicking on a malicious URL, according to bug hunter's reports.

An exploit could be distributed by e-mail as a URL the recipient is invited to click, or posted in a newsgroup or on a Web page.

Urged to Update

However, it is plugged by SP1, says Steve Gibson, a security expert and software developer who warns about the flaw in very general terms on his Web site.

According to Gibson, "this vulnerability is so dangerous that it would be irresponsible for me to say more" about how it works. He claims Microsoft has known of this problem for months but did not immediately post a separate security fix, waiting until SP1.

PC World (US) editors were able to test the flaw, confirming that it works as alleged, and that SP1 appears to block the exploit.

Microsoft representatives say they are unaware of reports of a new flaw, but that Windows XP users should keep their versions of the OS up to date.

Timely Fix

Microsoft posted the Windows XP SP1 for free download on Monday afternoon. The company says it provides a collection of existing security fixes, driver updates, and other improvements.

Microsoft representatives have urged all Windows XP users to download and install SP1. Future updates to Win XP will require SP1 be installed, says Charmaine Gravning, a product manager.

Gibson and others, however, say its urgent that all Windows XP uses adopt SP1 promptly because it will fix the flaw that Microsoft does not acknowledge.

"The exploitation of a single easily designed URL that immediately erases the files in any directory of a Windows XP system will prove irresistible to the world's script kiddies," Gibson says. "All that's necessary is posting a note anywhere on the Internet for hapless users to click. Game over."

Early reports of the Windows XP vulnerability apparently came from Shane Hird, an Australian bug-hunter, according to Gibson and others. Hird describes the flaw and its exploit on his Web site, and says he notified Microsoft of the hole in June.

"Microsoft has noted they intend to roll the fix into SP1 for XP," Hird says in his report, noting that he "received no objections" when he told Microsoft he would publish the exploit advisory before SP1 posted.

The flaw was also a hot topic in postings on some Usenet and developer discussion groups.

Few Dramatic Changes

Microsoft describes SP1 as an update to "enhance security, reliability, and compatibility." It incorporates many of the bug fixes and minor tweaks, such as new drivers, that Microsoft has posted for download since Windows XP shipped last October.

Other new functions of SP1 are the capability for users and vendors to set the defaults for programs from third parties instead of Microsoft's bundled applications, such as the music players; and even to deactivate access to some of those bundled Microsoft programs.

Users now have a three-day grace period to reactivate their product license when the OS determines it has been installed on a second PC. Microsoft also dropped the price of additional product keys, the so-called family license, by US$5, so a second license costs $15 to $30 less than buying another full copy of the OS.

The 137MB SP1 is also available for purchase on a CD for $9.95.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

PC World Staff

PC World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?