Perimeter
10/22/2009
08:55 AM
Wolfgang Kandek
Wolfgang Kandek
Commentary
50%
50%

Microsoft And Mozilla Compete, Cooperate

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.The patch for MS09-054 Cumulative Security Update for Internet Explorer addressed four critical vulnerabilities in Microsoft's Internet Explorer for all versions in all underlying Windows operating systems. However, one of the vulnerabilities also impacted Firefox, the competing open-source browser developed by the Mozilla Foundation, and considered by many security experts a safer alternative than IE.

How could this happen? Is something sinister going on?

In Microsoft's .NET Framework 3.5 SP1, the runtime libraries needed to execute code developed under Microsoft's .NET installs for a plug-in called Windows Presentation Foundation in Firefox that enables the browser to execute XAML browser applications similar to the corresponding component in IE. This plug-in then serves as a conduit to the underlying flawed Windows component -- and, in effect, makes Firefox vulnerable to this attack.

Once the issue was raised by the press, Mozilla acted fast, pushing out a fix that disabled both the plug-in in question and also the .NET Framework Assistant plug-in. It turns out that disabling the second plug-in was an overreaction, which Mozilla has since fixed.

Both Mozilla and Microsoft published details and a time line of the issue in their blogs, and there is an update in the FAQ section of MS09-054 with further details.

Nothing sneaky went on here, and there's no conspiracy. It's just about striving for maximum comfort in computer use: Like any other software vendor, Microsoft tries to make its products as accessible as possible. And in this case, Microsoft decided to enable Firefox users to use XAML browser applications.

As for the patch, it would have been better if Microsoft had informed Mozilla of the problem on the day of the release as a courtesy. This would have saved everybody a couple of days of back and forth, and the Mozilla folks from working the weekend to create a fix. The good news is that Mozilla and Microsoft managed to connect and hopefully established an ongoing collaborative partnership that will help address and resolve similar issues in the future.

By the way, this is all a moot point for organizations that patch vulnerabilities with an aggressive time line. After all, the MS09-054 fix addresses all known attack vectors for this vulnerability, so both IE and Firefox are protected. Once applied, it becomes unnecessary and maybe even inconvenient to have Firefox auto disable this plug-in. -- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: http://www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0702
Published: 2015-04-20
Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.

CVE-2015-0703
Published: 2015-04-20
Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.

CVE-2015-1235
Published: 2015-04-19
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVE-2015-1236
Published: 2015-04-19
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a cr...

CVE-2015-1237
Published: 2015-04-19
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages ...

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.