XP Service Pack said to fix major flaw

Microsoft Corp. always urges users to update programs when it ships a Service Pack, but an easily exploited Windows XP flaw makes it especially important that users of the operating system download and install the newly released SP1 promptly, several security experts warn.

The Win XP flaw is described as a still little-known but critical vulnerability, and is described as "trivially easy" to exploit by some who have studied it. It could allow files on any PC running Windows XP to be deleted simply by clicking on a malicious URL, according to bug hunter's reports.

An exploit could be distributed by e-mail as a URL the recipient is invited to click, or posted in a newsgroup or on a Web page.

Urged to Update

However, it is plugged by SP1, says Steve Gibson, a security expert and software developer who warns about the flaw in very general terms on his Web site.

According to Gibson, "this vulnerability is so dangerous that it would be irresponsible for me to say more" about how it works. He claims Microsoft has known of this problem for months but did not immediately post a separate security fix, waiting until SP1.

PC World (US) editors were able to test the flaw, confirming that it works as alleged, and that SP1 appears to block the exploit.

Microsoft representatives say they are unaware of reports of a new flaw, but that Windows XP users should keep their versions of the OS up to date.

Timely Fix

Microsoft posted the Windows XP SP1 for free download on Monday afternoon. The company says it provides a collection of existing security fixes, driver updates, and other improvements.

Microsoft representatives have urged all Windows XP users to download and install SP1. Future updates to Win XP will require SP1 be installed, says Charmaine Gravning, a product manager.

Gibson and others, however, say its urgent that all Windows XP uses adopt SP1 promptly because it will fix the flaw that Microsoft does not acknowledge.

"The exploitation of a single easily designed URL that immediately erases the files in any directory of a Windows XP system will prove irresistible to the world's script kiddies," Gibson says. "All that's necessary is posting a note anywhere on the Internet for hapless users to click. Game over."

Early reports of the Windows XP vulnerability apparently came from Shane Hird, an Australian bug-hunter, according to Gibson and others. Hird describes the flaw and its exploit on his Web site, and says he notified Microsoft of the hole in June.

"Microsoft has noted they intend to roll the fix into SP1 for XP," Hird says in his report, noting that he "received no objections" when he told Microsoft he would publish the exploit advisory before SP1 posted.

The flaw was also a hot topic in postings on some Usenet and developer discussion groups.

Few Dramatic Changes

Microsoft describes SP1 as an update to "enhance security, reliability, and compatibility." It incorporates many of the bug fixes and minor tweaks, such as new drivers, that Microsoft has posted for download since Windows XP shipped last October.

Other new functions of SP1 are the capability for users and vendors to set the defaults for programs from third parties instead of Microsoft's bundled applications, such as the music players; and even to deactivate access to some of those bundled Microsoft programs.

Users now have a three-day grace period to reactivate their product license when the OS determines it has been installed on a second PC. Microsoft also dropped the price of additional product keys, the so-called family license, by US$5, so a second license costs $15 to $30 less than buying another full copy of the OS.

The 137MB SP1 is also available for purchase on a CD for $9.95.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

PC World Staff

PC World
Show Comments


James Cook University - Master of Data Science Online Course

Learn more >


Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >

Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Brand Post

Bitdefender 2018

Roam freely in the digital world. Critically acclaimed performance and security at your fingertips.

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?