Firefox At Risk Due to Sneaky Microsoft Plug-In

By Kevin Parrish, published on October 16, 2009 at 4:50 PM
Source: Tom's Guide US | Keywords: , , , , | Themes: The Internet, Software
Syndication: Add to your Google homepage Add to My Yahoo!

A secret plug-in installed by Microsoft puts Firefox users at risk of a malicious attack.

Remember how Microsoft reacted to Google inserting Chrome into Internet Explorer? The company wasn't happy, essentially telling the search engine giant to "get out." Now it looks as if the pot is calling the kettle black, as the latest Microsoft "Patch Tuesday" reveals that the company silently slipped in a plug-in for Mozilla's Firefox browser called Windows Presentation Foundation.

According to Computerworld, Microsoft's security engineers acknowledged the plug-in earlier this week (obviously), and said that the plug-in was pushed onto consumers through a Windows Update. Thanks to the plug-in, Firefox users were susceptible to an attack vector until it was addressed on Tuesday.

"While the vulnerability is in an IE component, there is an attack vector for Firefox users as well," the company said in this security blog. "The reason is that .NET Framework 3.5 SP1 installs a “Windows Presentation Foundation” plug-in in Firefox. Via this plug-in it is possible to launch XBAP (XAML Browser Application), and reach this vulnerability, from within Firefox."

The blog describes the attack as a "browse-and-get-owned" scenario. Firefox users need only to be lured to a malicious website set up for the attack. Unfortunately, Firefox users can't simply remove the plug-in: the "Disable" and "Uninstall" buttons are grayed out on all versions of Windows save for Windows 7.

Comments | Print | Send to a friend

Sponsored links

Comments

megamanx00 10/17/2009 12:59 PM
Hide
-6+

Yeah, I already disabled it. I'm not surprised.

ssalim 10/17/2009 1:00 AM
Hide
-15+

Fucking Microsoft.

gnookergi 10/17/2009 1:06 AM
Hide
-19+

WTF. I just looked this up in my plugins and disabled it. Don't put shit on my computer without my permission micro-dicks.

warezme 10/17/2009 1:14 AM
Hide
-4+

as if .NET was f*cked up enough, now this

cookoy 10/17/2009 1:25 AM
Hide
--1+

but the critical update release last tuesday (KB974417) will fix the problem? i don't have .net FW 3.5 installed and auto update is off, so i'm safe? don't see any MS WPF in my plug-ins list. guess the cyberwar already started and i'm just collateral damage. if you're not with me, then you're against me!

the_krasno 10/17/2009 1:38 AM
Hide
-1+

I disabled this on my XP computer as soon as I read this.

tektek 10/17/2009 1:47 AM
Hide
-4+

How i crave the old BBS days.... ascii this and ascii that!

maigo 10/17/2009 2:18 AM
Hide
-0+

Stupid M$, stay off my computer!

Anonymous 10/17/2009 2:22 AM
Hide
-1+

What's the purpose of this plugin?

Surely it must do something. Please write that in Toms.

dingumf 10/17/2009 2:25 AM
Hide
-6+

I really dislike the quality of Tom's Guide's articles.

WHAT IS THE PLUG-IN SUPPOSED TO DO?

alikum 10/17/2009 3:00 AM
Hide
-0+

This plug-in allows Silverlight to be run I believe.

Kelavarus 10/17/2009 3:04 AM
Hide
-6+

... Pff. Couldn't care less. Sucks for people that go to malicious websites, the most malicious site I visit is a crappy article on Tom's.

bustapr 10/17/2009 3:24 AM
Hide
-0+

How do I check plug-ins, so I can disable this right now?

Rab1d-BDGR 10/17/2009 3:55 AM
Hide
-0+

YOU BASTARDS! GET OUT OF MY COMPUTER!!!!!!!!!

...oh wait, I'm using Fedora. Phwew!

Anonymous 10/17/2009 4:07 AM
Hide
-5+

If only my pc games could run off of linux.

alikum 10/17/2009 4:07 AM
Hide
--1+

On a side note, if you think this plug-in poses a danger, think again! Javascript poses a greater danger than this yet all browsers come with JS enabled by default. Clearly, this article or Kevin is being biased.
I can at anytime write a JS code that makes you download malicious software unintentionally when you visit my site. The same goes for this plug-in. SO what's the big deal here? Just don't visit untrusted/untested sites!

Anonymous 10/17/2009 4:23 AM
Hide
-10+

Firefox is already disabling the plug-ins automatically. Nice.

mrmez 10/17/2009 4:31 AM
Show
clickwir 10/17/2009 5:21 AM
Hide
--1+

Yes yes, F microsoft for doing this. True. However it's open that anyone can just drop a file into Firefox and call it a plugin. I'm not saying I blame Mozilla Firefox, but this is a perfect example of why Firefox should take more control over what is allowed to be added and there should ALWAYS be a way to Disable or Uninstall.

clickwir 10/17/2009 5:25 AM
Hide
-0+

If you go get an addon from Firefox's repository, you get a dialog confirming you want to install it. The same should be true for something that tries to be added outside of that process. If I download Uncle Johns Widget plugin and don't have Firefox running, but it tries to alter Firefox to slip itself in... next time I start Firefox I should be asked if I want to allow it. And if I say yes, there must always be a Disable and Uninstall options. Always.

__-_-_-__ 10/17/2009 5:47 AM
Hide
--3+

and the solution.... L I N U X

Anonymous 10/17/2009 6:19 AM
Show
Anonymous 10/17/2009 7:16 AM
Hide
-6+

To say this plugin was secretly installed is not quite true. I've had .NET Framework 3.5 SP1 installed since it came out a couple years ago. I already knew about the Firefox plugin because it asked me if I wanted to install it. There's an optional .NET Framework 2.0 Netscape/Mozilla plugin also. However, I always download and install .NET Framework manually, so maybe they've recently become sneakier with the automatic updates.

As for not being able to remove it, keep in mind that you can't remove ANY plugins from within Firefox's add-ons menu. You must either uninstall the application that installed the plugin, or you can delete the plugin file from the plugins folder (or wherever the plugin was installed.)

inme 10/17/2009 9:15 AM
Hide
--1+

Ahhh I love linux more and more as the days go by. Peace, love, linux.

Anonymous 10/17/2009 9:36 AM
Hide
-2+

Article says> Firefox users can't simply remove the plug-in: the "Disable" and "Uninstall" buttons are grayed out on all versions of Windows save for Windows 7.
But not true, runnning XP and firefox, my disable button was not Grayed out
so I just disabled it.

ossie 10/17/2009 9:49 AM
Show
tacoslave 10/17/2009 10:07 AM
Hide
--2+

woah woah when did steve jobs take over microsoft and give balmer a handjob to fuck with the customers using firefox. He doesnt have enough fun messing with stuck up college students and the technologically ignorant!?!?? well whatever i use google chrome.

Anonymous 10/17/2009 11:42 AM
Show
anamaniac 10/17/2009 11:56 AM
Hide
-8+

maigo :
Stupid M$, stay off my computer!


Then stop running Microsoft Windows...

excalibur1814 10/17/2009 12:38 PM
Hide
-3+

Wahh, wahhhh, wahhh, wahhhhhh!

It's their Operting system and they can pretty much do what they like. You buy a licence to use the damn thing.

On another note, is this a story throwing a negative spin on things as I really CANNOT trust Toms article writers at this time due to the recent Apple posts which were absolute trash.

Regected 10/17/2009 1:58 PM
Hide
--1+

This addon crashed on me last night, and I don't even have auto updates on. Go figure.


Sponsored links