Home >> Security >> Alerts, Patches and Fixes

Microsoft plug-in puts Firefox users at risk

By: Greg Keizer On: 16 Oct 2009 For: ComputerWorld (US) Creator

Microsoft add-on leaves Firefox users open to attack ...

An add-on that Microsoft silently slipped into Mozilla's Firefox last February leaves that browser open to attack, Microsoft's security engineers acknowledged earlier this week.

One of the 13 security bulletins Microsoft released Tuesday affects not only Internet Explorer (IE), but also Firefox, thanks to a Microsoft-made plug-in pushed to Firefox users eight months ago in an update delivered via Windows Update.

"While the vulnerability is in an IE component, there is an attack vector for Firefox users as well," admitted Microsoft engineers in a post to the company's Security Research & Defense blog on Tuesday. "The reason is that .NET Framework 3.5 SP1 installs a 'Windows Presentation Foundation' plug-in in Firefox."

The Microsoft engineers described the possible threat as a "browse-and-get-owned" situation that only requires attackers to lure Firefox users to a rigged Web site.

Numerous users and experts complained when Microsoft pushed the .NET Framework 3.5 Service Pack 1 (SP1) update to users last February, including Susan Bradley, a contributor to the popular Windows Secrets newsletter.

"The .NET Framework Assistant [the name of the add-on slipped into Firefox] that results can be installed inside Firefox without your approval," Bradley noted in a Feb. 12 story. "Although it was first installed with Microsoft's Visual Studio development program, I've seen this .NET component added to Firefox as part of the .NET Family patch."

What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox. The usual "Disable" and "Uninstall" buttons in Firefox's add-on list were grayed out on all versions of Windows except Windows 7, leaving most users no alternative other than to root through the Windows registry, a potentially dangerous chore, since a misstep could cripple the PC. Several sites posted complicated directions on how to scrub the .NET add-on from Firefox, including Annoyances.org .

Annoyances also said the threat to Firefox users is serious. "This update adds to Firefox one of the most dangerous vulnerabilities present in all versions of Internet Explorer: the ability for Web sites to easily and quietly install software on your PC," said the hints and tips site. "Since this design flaw is one of the reasons [why] you may have originally chosen to abandon IE in favor of a safer browser like Firefox, you may wish to remove this extension with all due haste."

Specifically, the.NET plug-in switched on a Microsoft technology dubbed ClickOnce, which lets .NET apps automatically download and run inside other browsers.

Microsoft reacted to criticism about the method it used to install the Firefox add-on by issuing another update in early May that made it possible to uninstall or disable the .NET Framework Assistant. It did not, however, apologize to Firefox users for slipping the add-on into their browsers without their explicit permission -- as is the case for other Firefox add-ons, or extensions.

This week, Microsoft did not revisit the origin of the .NET add-on, but simply told Firefox users that they should uninstall the component if they weren't able to deploy the patches provided in the MS09-054 update.

According to Microsoft, the vulnerability is "critical," and also can be exploited against users running any version of IE, including IE8

Sign up for our Newsletters

Tags: patches, browser, Internet Explorer, vulnerability, Firefox, Microsoft, Windows

Close X

Your Name:

Your E-mail:

Friend's Name:

Friend's E-mail:

Close X

| Views: 2278 | Rating:

(0 votes)

Rate this article on a scale of
1 to 5 stars,5 being the best.

Close X

Page 1

Quick Access

Video Conferencing Cloud Computing Resource Centre CIO Canada's Brainstorm Centre CIO Canada Debate IdeaCity Conference June 18-20 - Toronto

Greg Keizer is a contributor to the International Data Group (IDG) News Service, which publishes global technology stories from bureaus around the world to more than 300 publications in more than 60 countries.

Recent Canadian IT Jobs

more: IT Jobs , Post A Job

blog comments powered by Disqus

Computing Canada Poll

Read the Computing Canada articles you made happen.

• Democratizing Business Continuity
• Agility and efficiency through virtual switching

* Sponsored by Microsoft

Related White Papers

The Check Point Open Performance Architecture - The shift from network-layer attacks to dynamically changing application-layer threats has dramatically increased security performance needs. To address them requires an architecture that can quickly evolve to guarantee performance yet maintain a high level of security. While closed, ASIC-based architectures have not been able to make an efficient shift to protecting against application-layer threats. The Check Point Open Performance Architecture provides the foundation needed by large campuses and data centers to gain high performance while maintaining a high level of security.

The Path to Active Directory-Based Identity and Policy Management - This white paper from Centrify examines the business and technical case for centralizing identity and policy management in Microsoft's Active Directory.

Security Threats to Business, the Digital Lifestyle, and the Cloud - In 2013 and beyond, consumerization, virtualization and cloud are creating new opportunities for cybercriminals and others to attack businesses.

Manufacturer Simplifies Security Across All Platforms - B.C. based manufacturer simplifies security, eliminates admin and better fights threats. Learn more here.

Countering Advanced Persistent Threats with Cyber Forensics - The Future of Cybercrime Forensics Don’t be unprepared by targeted attacks – Click here to read.

more: White Papers