Firefox blocks insecure .Net add-on--awkwardly
Mozilla on Friday disabled a Microsoft plug-in for Firefox called the .Net Framework Assistant because of a security problem--then scrambled to give people with patched systems an override option.
Mike Shaver, Mozilla's vice president of engineering, announced the first step late Friday night on his blog. "It's recently surfaced that it has a serious security vulnerability, and Microsoft is recommending that all users disable the add-on," Shaver said. "Because of the difficulties some users have had entirely removing the add-on, and because of the severity of the risk it represents if not disabled, we contacted Microsoft today to indicate that we were looking to disable the extension and plug-in for all users via our blocklisting mechanism. Microsoft agreed with the plan, and we put the blocklist entry live immediately."
This warning sign greeted Firefox users after Mozilla blocked use of a Microsoft add-on.
(Credit: Screenshot by Stephen Shankland/CNET)The .Net Framework Assistant add-on lets Firefox use Microsoft's ClickOnce technology for installing applications that run on its .Net programming foundation. The add-on already was something of a thorn in the sides of some Firefox users: it was automatically installed via Windows Update with the .Net Framework 3.5 Service Pack 1 without telling the user the add-on was being installed or giving an option. More hackles were raised because it wasn't compatible with Firefox 3.5, Shaver said, and because removing it initially required people to edit their Windows Registry--a technically onerous task for most people.
Firefox checks a Mozilla server periodically for a list of add-ons to avoid. Although Mozilla's blocking move was intended to protect users, it caused other problems. Shaver indicated that Firefox's changed behavior irked some system administrators.
That led Justin Angel, a former Silverlight program manager at Microsoft, to tweet, "When business users can't use their core business functionality--they uninstall stuff."
One issue was that Mozilla's add-on blocking technology couldn't tell if people had patched their software and so weren't vulnerable anymore. "We can't distinguish patched from unpatched, so we're blocking it while we sort that out," Shaver twittered. Over the weekend, Mozilla worked to remedy the situation.
"Pushing a change to our blocklist software that will let Firefox 3.5 users override the blocking of .NET FA/WPF plugin if they're patched," Shaver tweeted Sunday. But a few hours later, he added, "We're still working on the blocklist tweaks to help enterprises override the blocking of the WPF plugin, stay tuned!"
Update 6:47 p.m. PDT: Crisis partially averted, apparently. At about 6:10 p.m., Shaver tweeted, "MSFT confirmed that the .NET Framework Assistant is not exploitable, so we've removed it from the blocklist; one down!"
Update 8:34 p.m. PDT: There's still another blocked Microsoft add-on that's vulnerable, one that concerns the Windows Presentation Foundation (WPF), which also is installed with the .Net service pack. Shaver said it was more serious.
"We're hard at work on improving the experience for (especially enterprise) users who wish to override the blocking of the WPF plugin before we remove it from the blocklist," Shaver said in a Sunday night blog post that announced the other plug-in had been removed from the Firefox blocked add-on list.
Stephen Shankland writes about a wide range of technology and products, but has a particular focus on browsers and digital photography. He joined CNET News in 1998 and since then also has covered Google, Yahoo, servers, supercomputing, Linux and open-source software, and science. E-mail Stephen, or follow him on Twitter at http://www.twitter.com/stshank. 
The big question is, why is Microsoft sneaking in add-ons to a competing browser in the first place, especailly w/o user permission or even knowledge? I'm sure they'd go apes^!t if a third-party app maker decided to do something similar with IE.
Microsoft's little .NET addon to Firefox was crammed down the throats of ever Windows-based Firefox user, whether they wanted it or not. The bigger problem is that the forced patch also opened a big fat security hole: http://www.microsoft.com/technet/security/bulletin/ms09-054.mspx
@Lerianis3 When you installed Flash did you only expect it to be installed to IE or FF or did you expect it in all of them? Considering SL is a flash competitor kind of obvious it will go into all of them.
/s
Would you rather it had been done later, yet more gracefully, at the price of more users exposed for longer?
Yes!
I'm sure there's thousands of unpatched scenerios on millions of machines. Should companies just start blocking things as they pelase?
Should ISPs start blocking your computer from the internet if you're running XP SP1 and havent updated since? I'm sure that's a bigger threat to the public than this .net issue. Maybe e-mail accounts should all be disabled if the password is 123456.
The bigger question is, should companies sneak in add-ons to competitors' products in the first place? Windows users had no choice in the matter - Microsoft plopped it into Firefox without users' knowledge or consent. It showed up after-the-fact, with no recourse by the user.
It has nothing to do with "millions of unpatched scenarios" nor does it have to do with the idea of ISP's blocking your computer from the Internet if you're running XP SP1 and haven't patched since. What this has to do with is that if you installed .NET Framework 3.5 SP1 and had Firefox installed, it automatically installed this addon. You may like it, and a lot of enterprise users may like it. However, the original purpose of Firefox was an alternative to IE and ActiveX technology. And the fact that it was installed WITHOUT YOU KNOWING is a big issue.
This addon introduces ActiveX technology to Firefox. While a lot of people may think it's a good thing, the fact that Microsoft did NOT give anyone a choice in the matter is not a good thing. There's probably an equal number of people who use Firefox for their daily needs-- and use Internet Explorer when the site requires ActiveX. Why should their choice of whether or not to have the functionality in Firefox be decided by Microsoft or anyone else but them?
Personally, I think that Mozilla should have banned the addon from Day 1. Please understand that I use Internet Explorer for a lot of my surfing, but if I am not sure if I trust the site, I use Firefox to check it first (with No-Script and other security addons running). To find out that my security plan may be vulnerable because I installed .NET Framework 3.5 SP1 utterly p!sses me off. I'm one of the people who followed the registry tweak method to remove this addon.
Have a great day:)
Patrick.
Windows users had no choice in the matter - Microsoft plopped it into Firefox without users' knowledge or consent.
-------------------------------------------------------------------
Slaves never have, nor should they ever have, a say in how the plantation is run.
"This addon introduces ActiveX technology to Firefox. " That's quite far from the truth
The early versions of this "add on" wouldn't even allow you to uninstall or disable it. You were stuck whether you liked it or not.
And yes, the .NET Framework itself has multiple vulns: http://secunia.com/advisories/26003/
Example: iTunes
If you install QuickTime or iTunes, you get the other included. And even if you never have an iPod or iPhone, if you open up the task manager and look at the processes you'll find that you're wasting system ressources running iTunesHelper and iPodServices. Those are there running, you know, in case you some day buy an iPod/iPhone and plug it in. Then it will be ready and waiting. It just comes with the apps without your knowledge.
*shrugs* If it's okay for Apple to do this sort of thing, why isn't it okay for everyone?
No software company has any right to add anything to any piece of software on my computer without my permission. Yet again one of these companies proves they cannot be trusted to do the morally right or legally right thing.
I'm sure if a lawyer type person looked into this, there must be some law prohibiting companies from altering someone's property without their permission.
I also cannot believe no one else is complaining about this. I am outraged. Once again we are raising an entire generation that is so used to these companies telling them what's good for them that they have started believing it and accepting it as normal.
If I owned a big company and had lost time because of this I would definitely have my lawyers looking into it.
And as for "That led Justin Angel, a former Silverlight program manager at Microsoft, to tweet, "When business users can't use their core business functionality--they uninstall stuff." "
You just prove that a programmer does not have to be a genius. It seems to me that all these problems were started by MS adding .net to FF without anyone's permission, so it also seems to me that if there's any uninstalling to be done, it should be .net, not FF. Get a freeking brain.
When is FF going to make damn 100% sure that nothing can be installed to FF without being easily uninstallable? I have run into this same problem with some anti-virus software and, IMAO, it makes that software almost as bad as the viruses! Since when should we not be able to remove software we don't want, for ANY reason, from our own computers? For about the 10, 000th time I have to say the ONLY thing keeping me using Windows is that the software I want to use is on that platform. If I could run my current software on Linux, my home computers AND all my business computers would be running Linux and not Windows.
If Mozilla Foundation cannot keep control of their own software, then how about just preventing ANY additions since we cannot trust that we will be able to remove them? How about a selection in the options that says "Prevent any software from modifying FF (Y/N)".
Get with it Mozilla people. Are you asking us to stop using your software because you can't prevent these things from happening? Get some balls and threaten a lawsuit if MS doesn't stop doing this. Of course, I guess I could always just stop using FF. If that's what you're looking for......
Once again Dan, you need to do your homework.
Anyone?
Buehler?
Thought so.
The iPod/iPhone helper is installed also, but it's an integral part of iTunes (since iTunes is intended to synch your music from your computer to your ummmmmm IPOD and IPHONE). You can simply go into Services and disable it. Originally you couldn't do anything that simple with the "Click Once" plugin that Microsoft installed.
When I installed .NET Framework 3.5 SP1, the only indication that anything was added to Firefox was when I did a manual check for updates (or when I installed another addon). That's wrong in every sense of the word.
Also for the comment that these .NET things shouldn't be installed on consumer's machines.... Any program that you install, which has been created in Visual Studio (and there are a lot of them) uses the .NET Framework. If you look at the installer (or CD) and it contains a file called dotnetfix.exe, then it's using the .NET Framework. My printer (Lexmark X2350), camera (Kodak camera), weather alert program (WeathAlert), PlanPlus software, and quite a few other programs fall into this category. Only the "PlanPlus software" could be considered business use. You'd be surprised how many games fall into this category also.
Have a great day:)
Patrick.
That is like saying it was ever a good idea to build your "core business system" using ActiveX..
Loooooosseeeerrrr
Got me so pissed I immedicately cancelled our Netflix subscription.
... and you can still buy ActiveX controls for development (although they have seen the light at the end of the tunnel and are headed for it.)
I am more and more impressed with .NET (not) ... especially since I have to reinvent all the cool things I created in a new noncompatible decompilable language and the recommended way to approach about half of them is pInvoking Win32 APIs ... which by the way, makes that functionality secure but then it is not 'pure' ... oh brother.
Actually I used to stream Netflix.. Then one day last spring it said I had to install Silverlight to watch 'Gandhi'. Did so on a guinea pig laptop to test it. Then Netflix refused to run on my other 'real' machine because it had automatically set my account preferences to use Silverlight on all machines. I called / emailed customer service multiple times trying to restore to previous settings, from about 10 minutes before. They said it was 'impossible'. They would not reset account settings to non-Silverlight, by corporate policy.
Got me so pissed I immedicately cancelled our Netflix subscription.
___________________________________
You should have immediately threatened a lawsuit over that, and they would have changed it back REAL fast.
After Mozilla blocked the MS addons, all my problems disappeared. I don't even browse to Silverlight sites... not sure why it was making so many troubles. Anyway, I uninstalled MS crap and will keep an eye on it in the future :). But I too find it outrageous that MS installed Silverlight on my computer without asking for my permission.
Whats even more shocking is that they secrely included an update to 3rd party software, that pretty quetional is you ask me. Whats even more odd is that Apple can secretly install ITunes while you where just installing lets say QuickTime video player... Get my driffet, this means that any software vender can potentally install any thing they want on to your windows box, which to is one big security hole... Also it not just installing but running too~ ;). Heh heh, Scarrry isn't it. Hmm, I was wondering how some one installed a funny little scripted that destroid my ability to log in to my labtop...
Well enough rambling, my adviced to Monzilla is to create an alert component that detectes any other entity other than the user installing plugins. This component will alert its user that some one other than the user is going to install a plugin, this will give the user a nice little prompt, the first button will say "yes" and the second button will say "NO!!!".
Also to Mergatroid Mania google WINEHQ. :D
Their Lameduck Challenge certainy turned me into a custormer...
I am using FF to debug a WPF app I am writing and I do want the functionality of the .NET assistant because I am developing in .NET and ... FF is my browser of choice.
So HOW DO I RE-ENABLE/INSTALL THESE ADD ONS?
When I saw the message I was, like, "that's odd." So I followed the "More Info" link and I find a bunch of propeller heads (almost like me but with a deep hatred of MSFT) talking a bunch of crap. I followed the links that were 'supposedly' to some MSFT official who said that everyone should disable these add ons ... now and it was a dead link. So instead of a warning that I may want to temporartily disable these add ons (that only an uber geek could exploit) while some more research is done and the problems could BE VERIFIED ... I have somebody else controlling my choices.
And I don't want to get off on a rant here but ...
What is with this trend in software of removing options and functionality ... there are no simple ways to deal with cache and cookies in the latest couple versions of FF. I have installed a couple add ons and will be looking into it but ... give me a break. i just want a place where I can add adserver.com (and a ton of others) to a list of places that I never want to accept cookies from. Then a way to export or import that list to and from a simple text file. That is called functionality and convenience. IE doesn't have it either. I use NIS (okay, I know ... but I have used it for over ten years ... even back to when it was a pretty good product). So my background scan finds a tracking cookie ... and deletes it. It is the same one it found for the last twenty times. Any functionality for blocking it? Nope. In fact you have to dig through four screens to even see from where it came and then? There is no way to even highlight and 'blankity blank' copy it to the clipboard. Very functional, that. Sounds like they need a few more 'Program Managers' over there to (insert pointless buzz words here).
I should have become a commercial fisherman.
Can you show me which websites actually use them?
Would you be happy if the ebay auction sniper just automatically installed itself the next time you opened Firefox? Or the next time you went to Ebay (whether it was in Firefox or Internet Explorer)? And would you be happy if you couldn't uninstall the addon?
One thing that some people are overlooking is that Mozilla contacted Microsoft BEFORE they blocked the addons. Microsoft agreed with them that it should be done. Then Mozilla blocked them. When Microsoft said that the one addon is patched, Mozilla unblocked it. It's not like Mozilla did this without Microsoft or anyone else knowing-- quite the contrary to the actual installation of the addon in the first place.
Have a great day:)
Patrick.
The problem is that Windows is such a core piece of software, because it is what allows the user to operate the computer. You can get along without iTunes, and you can switch antivirus programs, but most people either can't or aren't willing to change operating systems. So when Microsoft uses Windows as a launchpad to push its other products, it is much more intrusive than a regular application doing so. Security risks are also a lot higher.
If I had to decide between making sure that everyone was safe (until they patched up properly) or risking millions of infected people who all will say "I only use Firefox, so how did I get infected?", I'd choose to block and make sure they are safe. But, that's just me.
Have a great day;)
Patrick.
The morons at Mozilla/Firefox delete first, and ask questions later.
You know, it's usually a good thing to know that something's secure before pushing it to thousands of users. So I am glad that Mozilla will block something if there's even a question that it may not be secure.
- by Nestiiii October 19, 2009 6:38 AM PDT
- @ Mergatroid Mania
- Like this Reply to this comment
-
Showing 1 of 2 pages (86 Comments)omg. you have no idea how software is done these days... sorry but with your statement you outed yourself... are you a lawyer?
But I like to read the comments on cnet - as a software developer it's fun to see what perception of software the "average computer user" has.