XP Service Pack said to fix major flaw

Microsoft Corp. always urges users to update programs when it ships a Service Pack, but an easily exploited Windows XP flaw makes it especially important that users of the operating system download and install the newly released SP1 promptly, several security experts warn.

The Win XP flaw is described as a still little-known but critical vulnerability, and is described as "trivially easy" to exploit by some who have studied it. It could allow files on any PC running Windows XP to be deleted simply by clicking on a malicious URL, according to bug hunter's reports.

An exploit could be distributed by e-mail as a URL the recipient is invited to click, or posted in a newsgroup or on a Web page.

Urged to Update

However, it is plugged by SP1, says Steve Gibson, a security expert and software developer who warns about the flaw in very general terms on his Web site.

According to Gibson, "this vulnerability is so dangerous that it would be irresponsible for me to say more" about how it works. He claims Microsoft has known of this problem for months but did not immediately post a separate security fix, waiting until SP1.

PC World (US) editors were able to test the flaw, confirming that it works as alleged, and that SP1 appears to block the exploit.

Microsoft representatives say they are unaware of reports of a new flaw, but that Windows XP users should keep their versions of the OS up to date.

Timely Fix

Microsoft posted the Windows XP SP1 for free download on Monday afternoon. The company says it provides a collection of existing security fixes, driver updates, and other improvements.

Microsoft representatives have urged all Windows XP users to download and install SP1. Future updates to Win XP will require SP1 be installed, says Charmaine Gravning, a product manager.

Gibson and others, however, say its urgent that all Windows XP uses adopt SP1 promptly because it will fix the flaw that Microsoft does not acknowledge.

"The exploitation of a single easily designed URL that immediately erases the files in any directory of a Windows XP system will prove irresistible to the world's script kiddies," Gibson says. "All that's necessary is posting a note anywhere on the Internet for hapless users to click. Game over."

Early reports of the Windows XP vulnerability apparently came from Shane Hird, an Australian bug-hunter, according to Gibson and others. Hird describes the flaw and its exploit on his Web site, and says he notified Microsoft of the hole in June.

"Microsoft has noted they intend to roll the fix into SP1 for XP," Hird says in his report, noting that he "received no objections" when he told Microsoft he would publish the exploit advisory before SP1 posted.

The flaw was also a hot topic in postings on some Usenet and developer discussion groups.

Few Dramatic Changes

Microsoft describes SP1 as an update to "enhance security, reliability, and compatibility." It incorporates many of the bug fixes and minor tweaks, such as new drivers, that Microsoft has posted for download since Windows XP shipped last October.

Other new functions of SP1 are the capability for users and vendors to set the defaults for programs from third parties instead of Microsoft's bundled applications, such as the music players; and even to deactivate access to some of those bundled Microsoft programs.

Users now have a three-day grace period to reactivate their product license when the OS determines it has been installed on a second PC. Microsoft also dropped the price of additional product keys, the so-called family license, by US$5, so a second license costs $15 to $30 less than buying another full copy of the OS.

The 137MB SP1 is also available for purchase on a CD for $9.95.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

PC World Staff

PC World
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?