Perimeter
10/22/2009
08:55 AM
Wolfgang Kandek
Wolfgang Kandek
Commentary
50%
50%

Microsoft And Mozilla Compete, Cooperate

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.The patch for MS09-054 Cumulative Security Update for Internet Explorer addressed four critical vulnerabilities in Microsoft's Internet Explorer for all versions in all underlying Windows operating systems. However, one of the vulnerabilities also impacted Firefox, the competing open-source browser developed by the Mozilla Foundation, and considered by many security experts a safer alternative than IE.

How could this happen? Is something sinister going on?

In Microsoft's .NET Framework 3.5 SP1, the runtime libraries needed to execute code developed under Microsoft's .NET installs for a plug-in called Windows Presentation Foundation in Firefox that enables the browser to execute XAML browser applications similar to the corresponding component in IE. This plug-in then serves as a conduit to the underlying flawed Windows component -- and, in effect, makes Firefox vulnerable to this attack.

Once the issue was raised by the press, Mozilla acted fast, pushing out a fix that disabled both the plug-in in question and also the .NET Framework Assistant plug-in. It turns out that disabling the second plug-in was an overreaction, which Mozilla has since fixed.

Both Mozilla and Microsoft published details and a time line of the issue in their blogs, and there is an update in the FAQ section of MS09-054 with further details.

Nothing sneaky went on here, and there's no conspiracy. It's just about striving for maximum comfort in computer use: Like any other software vendor, Microsoft tries to make its products as accessible as possible. And in this case, Microsoft decided to enable Firefox users to use XAML browser applications.

As for the patch, it would have been better if Microsoft had informed Mozilla of the problem on the day of the release as a courtesy. This would have saved everybody a couple of days of back and forth, and the Mozilla folks from working the weekend to create a fix. The good news is that Mozilla and Microsoft managed to connect and hopefully established an ongoing collaborative partnership that will help address and resolve similar issues in the future.

By the way, this is all a moot point for organizations that patch vulnerabilities with an aggressive time line. After all, the MS09-054 fix addresses all known attack vectors for this vulnerability, so both IE and Firefox are protected. Once applied, it becomes unnecessary and maybe even inconvenient to have Firefox auto disable this plug-in. -- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: http://www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5314
Published: 2014-11-23
Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.

CVE-2014-5325
Published: 2014-11-23
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity refe...

CVE-2014-5326
Published: 2014-11-23
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-6477
Published: 2014-11-23
Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4...

CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?