Security Advisory
Microsoft Security Advisory 897663
Windows Firewall Exception May Not Display in the User Interface
Published: August 31, 2005
Microsoft has received a report of an unexpected behavior in the way that the Windows Firewall User Interface handles malformed entries in the Windows Registry. By creating malformed Windows Firewall exception entries in the Windows Registry, an exception could be created in the firewall that would not be displayed in the Windows Firewall User Interface. However, this exception is displayed by the command line firewall administration tools.
It is important to note that this is not a vulnerability. Administrative privileges are required to access the associated section of the Windows Registry that contains this configuration information. By using documented methods to manage and create Windows Firewall exceptions, it is unlikely that a malformed registry entry will be produced which would exhibit this behavior. It is more likely that an attacker who has already compromised the system would create such malformed registry entries with intent to confuse a user.
Microsoft plans to include an update to address this concern as part of a future service pack on the affected supported platforms.
General Information
Overview
Purpose of Advisory: Notification of an unexpected behavior in the Windows Firewall User Interface.
Advisory Status: Microsoft Knowledge Base Article updated and associated update released.
Recommendation: Review the suggested actions and configure as appropriate.
| References | Identification |
|---|---|
| Microsoft Knowledge Base Article | 897663 |
This advisory discusses the following software.
| Related Software |
| Microsoft Windows XP Service Pack 2 |
| Microsoft Windows XP Professional x64 Edition |
| Microsoft Windows Server 2003 Service Pack 1 |
| Microsoft Windows Server 2003 with SP1 for Itanium-based Systems |
| Microsoft Windows Server 2003 x64 Edition |
Frequently Asked Questions
What is the scope of the advisory?
This advisory addresses a concern about unexpected behavior in the way the Windows Firewall User Interfaces handles malformed entries in the Windows Registry. By creating malformed Windows Firewall exception entries in the Windows Registry, an exception could be created in the firewall which would not be displayed in the Windows Firewall User Interface. Administrative privileges are required to access the associated section of the Windows Registry which contains this configuration information.
Is this a security vulnerability that requires Microsoft to issue a security update?
Although this is not a security vulnerability, this non-security update was issued to provide users a way to display malformed Windows Firewall configuration registry entries. For more information about Windows Firewall, see the following Web site.
What causes this issue?
The way that the Windows Firewall User Interface handles some malformed registry entries.
What is a Windows Firewall exception?
By default, the Windows Firewall blocks incoming network connections. Administrators can allow inbound network connections by creating an exception in the Windows Firewall configuration to allow access to network services running on the machine.
What is the impact of this issue?
This issue cannot be used to compromise a system. If a system has already been compromised by some other method, this issue could be used as an attempt to hide exceptions in the firewall. However, the command line tools listed in the “Suggested Actions” section of this advisory would correctly display the exceptions.
Suggested Actions
Review the Microsoft Knowledge Base Article that is associated with this advisory and install the associated update.
Customers who are interested in learning more about this issue should review Microsoft Knowledge Base Article 897663.
Workarounds
Microsoft has tested the following workaround. While this workaround will not correct the underlying issue, it will allow administrators to view a complete list of defined exceptions.
View Windows Firewall Exceptions by using Netsh Firewall
- Click Start, click Run, type cmd, and then click OK.
- Type netsh firewall show state verbose = ENABLE, and then click OK.
- Search the output text for the following text:
Ports currently open on all network interfaces
The ports and programs that are listed in the Ports currently open on all network interfaces section are unblocked. Additionally, these unblocked ports and programs represent enabled program or port exceptions.
Protect Your PC
We continue to encourage customers follow our Protect Your PC guidance of enabling a firewall, getting software updates and installing ant-virus software. Customers can learn more about these steps by visiting Protect Your PC Web site.
For more information about staying safe on the Internet, customers can visit theMicrosoft Security Home Page.
Keep Windows Updated
All Windows users should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit the Windows Update Web site, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have Automatic Updates enabled, the updates are delivered to you when they are released, but you have to make sure you install them.
Other Information
Resources:
- You can provide feedback by completing the form by visiting the following Web site.
- Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services. For more information about available support options, see the Microsoft Help and Support Web site.
- International customers can receive support from their local Microsoft subsidiaries. For more information about how to contact Microsoft for international support issues, visit the International Support Web site.
- The Microsoft TechNet Security Web site provides additional information about security in Microsoft products.
Disclaimer:
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions:
- August 31, 2005: Advisory published
Built at 2014-04-18T13:49:36Z-07:00