Perimeter
10/22/2009
08:55 AM
Wolfgang Kandek
Wolfgang Kandek
Commentary
50%
50%

Microsoft And Mozilla Compete, Cooperate

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.The patch for MS09-054 Cumulative Security Update for Internet Explorer addressed four critical vulnerabilities in Microsoft's Internet Explorer for all versions in all underlying Windows operating systems. However, one of the vulnerabilities also impacted Firefox, the competing open-source browser developed by the Mozilla Foundation, and considered by many security experts a safer alternative than IE.

How could this happen? Is something sinister going on?

In Microsoft's .NET Framework 3.5 SP1, the runtime libraries needed to execute code developed under Microsoft's .NET installs for a plug-in called Windows Presentation Foundation in Firefox that enables the browser to execute XAML browser applications similar to the corresponding component in IE. This plug-in then serves as a conduit to the underlying flawed Windows component -- and, in effect, makes Firefox vulnerable to this attack.

Once the issue was raised by the press, Mozilla acted fast, pushing out a fix that disabled both the plug-in in question and also the .NET Framework Assistant plug-in. It turns out that disabling the second plug-in was an overreaction, which Mozilla has since fixed.

Both Mozilla and Microsoft published details and a time line of the issue in their blogs, and there is an update in the FAQ section of MS09-054 with further details.

Nothing sneaky went on here, and there's no conspiracy. It's just about striving for maximum comfort in computer use: Like any other software vendor, Microsoft tries to make its products as accessible as possible. And in this case, Microsoft decided to enable Firefox users to use XAML browser applications.

As for the patch, it would have been better if Microsoft had informed Mozilla of the problem on the day of the release as a courtesy. This would have saved everybody a couple of days of back and forth, and the Mozilla folks from working the weekend to create a fix. The good news is that Mozilla and Microsoft managed to connect and hopefully established an ongoing collaborative partnership that will help address and resolve similar issues in the future.

By the way, this is all a moot point for organizations that patch vulnerabilities with an aggressive time line. After all, the MS09-054 fix addresses all known attack vectors for this vulnerability, so both IE and Firefox are protected. Once applied, it becomes unnecessary and maybe even inconvenient to have Firefox auto disable this plug-in. -- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: http://www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

CVE-2015-0885
Published: 2015-02-27
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.