No firewall, and in explaination that ubuntu doesn't install any service applications. But in truth the first thing that is started up is a service application which is very vulnerable by default and opens it's port the world. X is still a vulnerable application and is still running the service on an open port.