Apparently some are of the opinion this is not a security vulnerability, according to Microsoft’s comments to ZDNet reporters, but in the real world – it’s a hole. A Mack-Truck-sized security hole. The news story reads a bit like one team saying “Hey, we’re not in charge of that, so it’s not a problem” and the other one saying “We do things the way we do them, and that’s what we do.” Oof.

Anyhow… If you run Windows XP with SP2 you need to make sure you have this update.

http://support.microsoft.com/default.aspx?scid=kb;en-us;886185

SYMPTOMS
After you set up Microsoft Windows Firewall in Microsoft Windows XP Service Pack 2 (SP2), you may discover that your computer can be accessed by anyone on the Internet when you use a dial-up connection to connect to the Internet.

CAUSE
This problem occurs because of the way that Windows Firewall interprets local subnets when the “My network (subnet) only” option is used. Windows Firewall is included with Windows XP SP2.

Because of the way that some dialing software configures routing tables, Windows Firewall in Windows XP SP2 can sometimes interpret the whole Internet to be a local subnet. This can let anyone on the Internet access the Windows Firewall exceptions. When the "My network (subnet) only" option is enabled, it is automatically selected for file and print sharing. Therefore, your shared drives can be unexpectedly revealed on the Internet when you use a dial-up connection.

RESOLUTION
To resolve this problem, you must download and install the Critical Update for Windows XP (KB886185).

Use Windows Update or click the above link. If you’re not already set up for automatic updates, make that change now.