Darned if I know. Microsoft wrote their own IP stack as a subset of their TDI interface. I don't have the patience to go through all the microsoft documentation to find out whether microsoft's listen() always has the same behaviour as POSIX.1's listen() .
Well, since the original poster did not say anything about what kind of system it is, I suppose there's a chance that it is WinSrv03 R2, but since that's not a very common operating system, if that prospect is to be seriously considered then so too should be the possibility that some other OS (or some old Windows OS) is present.
You already know my conclusion: that in the absense of information that establishes that the OP is definitely running a secured system, that the OP needs to be told "Yes, you may well need a firewall".
It should be the First Fundamental Theorem of comp.security.firewalls : that a firewall is needed until the situation is proven safe. If we are missing important information about the situation, then we should not be telling anyone that they definitely do not need a firewall.