Mitigating Factors: Internet Explorer 8 is not affected and Protected Mode in Internet Explorer 7 in Windows Vista limits the impact of the vulnerability.

but it's not enabled by default in IE7. And XP hasn't ASLR.

XP TCP/IP stack is obsolete. Vista TCP/IP stack is much better. Yet another reason to use Vista

UAC is NOT poorly implemented. UAC implementation is much better than Linux's sudo. The programs are poorly implemented assuming administrative privileges for everything!