Mozilla Disables Microsoft's Insecure Firefox Add-on

[javajolt]

Mozilla is disabling a pair of components stealthily installed by Microsoft earlier this year for Windows users of the Firefox Web browser, warning that the software suffers from a serious security vulnerability.

Firefox users may already have seen a pop-up notice about an unstable or insecure add-on being disabled. The message would look something like image below.

There's a short backstory to this drama. In May, I wrote about a Windows patch for the Microsoft .NET package that silently installed the Microsoft .NET Framework Assistant add-on into Firefox. The package also included an associated plug-in for Firefox called the Windows Presentation Foundation plug-in. The Mozilla user community was up arms over not just the fact that Microsoft was introducing unwanted components that could potentially weaken the security of Firefox, but that Redmond had made the thing almost impossible to remove.

Microsoft's initial response -- that the add-on could be removed by editing the Windows registry -- drew criticism because editing the registry is potentially dangerous affair for newbie users. In response, Microsoft later shipped a simpler, point-and-click way to remove the thing. Still, the removal tool still left behind the Windows Presentation Foundation plug-in.

Fast forward to earlier this month, when Microsoft issued a record number of security updates. Among those was a fix for what Microsoft called a "browse-and-get-owned" vulnerability in Internet Explorer, meaning all that is needed is for a user to be lured to a malicious website. Nothing particularly new there, except that this one could also be exploited through Firefox, via the Windows Presentation Plug-in.

Microsoft has been quick to point out that Windows users who have applied this month's updates are protected from this attack, regardless of which browser they use. Still, that was apparently not enough for Mozilla. Mike Shaver, Mozilla's vice president of engineering, said the company decided to nix the components because of the threat they introduce, and because many Windows users may not have understood previous instructions on how to remove them manually.

"Because of the difficulties some users have had entirely removing the add-on, and because of the severity of the risk it represents if not disabled, we contacted Microsoft today to indicate that we were looking to disable the extension and plugin for all users via our blocklisting mechanism. Microsoft agreed with the plan, and we put the blocklist entry live immediately," Shaver wrote Friday on the Mozilla Security Blog.

I first noticed the pop-up pictured above earlier this afternoon while I was browsing the Web. I was initially confused because I had long ago removed the .NET Framework add-on. Turns out, I had forgotten to disable the associated plug-in. This update from Mozilla appears to have done that for me (thanks, Mozilla!).

source:washingtonpost

[javajolt]

Mozilla on Friday disabled a Microsoft plug-in for Firefox called the .Net Framework Assistant because of a security problem--then scrambled to give people with patched browsers an override option.

Mike Shaver, Mozilla's vice president of engineering, announced the first step late Friday night on his blog. "It's recently surfaced that it has a serious security vulnerability, and Microsoft is recommending that all users disable the add-on," Shaver said. "Because of the difficulties some users have had entirely removing the add-on, and because of the severity of the risk it represents if not disabled, we contacted Microsoft today to indicate that we were looking to disable the extension and plug-in for all users via our blocklisting mechanism. Microsoft agreed with the plan, and we put the blocklist entry live immediately."

This warning sign greeted Firefox users after Mozilla
blocked use of a Microsoft add-on.

The .Net Framework Assistant add-on lets Firefox use Microsoft's ClickOnce technology for installing applications that run on its .Net programming foundation. The add-on already was something of a thorn in the sides of some Firefox users: it was automatically installed via Windows Update with the .Net Framework 3.5 Service Pack 1 without telling the user the add-on was being installed or giving an option. More hackles were raised because it wasn't compatible with Firefox 3.5, Shaver said, and because removing it initially required people to edit their Windows Registry--a technically onerous task for most people.

Firefox checks a Mozilla server periodically for a list of add-ons to avoid. Although Mozilla's blocking move was intended to protect users, it caused other problems. Shaver indicated that Firefox's changed behavior irked some system administrators.

That led Justin Angel, a former Silverlight program manager at Microsoft, to tweet, "When business users can't use their core business functionality--they uninstall stuff."

One issue was that Mozilla's add-on blocking technology couldn't tell if people had patched software that wasn't vulnerable. "We can't distinguish patched from unpatched, so we're blocking it while we sort that out," Shaver twittered. Over the weekend, Mozilla worked to remedy the situation.

"Pushing a change to our blocklist software that will let Firefox 3.5 users override the blocking of .NET FA/WPF plugin if they're patched," Shaver tweeted Sunday. But a few hours later, he added, "We're still working on the blocklist tweaks to help enterprises override the blocking of the WPF plugin, stay tuned!"

Update 6:47 p.m. PDT: Crisis averted, apparently. At about 6:10 p.m., Shaver tweeted, "MSFT confirmed that the .NET Framework Assistant is not exploitable, so we've removed it from the blocklist; one down!"

source:cnet