In the revised advisory, Microsoft explained why it won’t patch Windows XP, the
world’s most popular operating system
. “By default, Windows XP SP2, Windows XP SP3 and Windows XP Professional x64 Edition SP2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability,” the company said. “Windows XP SP2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network.”
Although the two bugs can be exploited on Windows 2000 and XP, Microsoft downplayed their impact. “A system would become unresponsive due to memory consumption … [but] a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases.”
Microsoft rated the vulnerabilities on Windows 2000 and XP as “important” on Windows 2000, and as “low” on XP. The company uses a four-step scoring system, where “low” is the least-dangerous threat, followed in ascending order by “moderate,” “important” and “critical.”
The same two bugs were ranked “moderate” for Vista and Server 2008, while a third — which doesn’t affect the older operating systems — was rated “critical.”
During the Q&A, however, Windows users repeatedly asked Microsoft’s security team to explain why it wasn’t patching XP, or if, in certain scenarios, their machines might be at risk. “We still use Windows XP and we do not use Windows Firewall,” read one of the user questions. “We use a third-party vendor firewall product. Even assuming that we use the Windows Firewall, if there are services listening, such as remote desktop, wouldn’t then Windows XP be vulnerable to this?”
“Servers are a more likely target for this attack, and your firewall should provide additional protections against external exploits,” replied Stone and Bryant.