My Apple, this is not so impressive... (From Heise Security) via MacRumors.com:
Leopard's firewall] is not activated by default and, even when activated, it does not behave as expected. Network connections to non-authorised services can still be established and even under the most restrictive setting, "Block all incoming connections," it allows access to system services from the internet.
Read on..