Perimeter
10/22/2009
08:55 AM
Wolfgang Kandek
Wolfgang Kandek
Commentary
50%
50%

Microsoft And Mozilla Compete, Cooperate

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.The patch for MS09-054 Cumulative Security Update for Internet Explorer addressed four critical vulnerabilities in Microsoft's Internet Explorer for all versions in all underlying Windows operating systems. However, one of the vulnerabilities also impacted Firefox, the competing open-source browser developed by the Mozilla Foundation, and considered by many security experts a safer alternative than IE.

How could this happen? Is something sinister going on?

In Microsoft's .NET Framework 3.5 SP1, the runtime libraries needed to execute code developed under Microsoft's .NET installs for a plug-in called Windows Presentation Foundation in Firefox that enables the browser to execute XAML browser applications similar to the corresponding component in IE. This plug-in then serves as a conduit to the underlying flawed Windows component -- and, in effect, makes Firefox vulnerable to this attack.

Once the issue was raised by the press, Mozilla acted fast, pushing out a fix that disabled both the plug-in in question and also the .NET Framework Assistant plug-in. It turns out that disabling the second plug-in was an overreaction, which Mozilla has since fixed.

Both Mozilla and Microsoft published details and a time line of the issue in their blogs, and there is an update in the FAQ section of MS09-054 with further details.

Nothing sneaky went on here, and there's no conspiracy. It's just about striving for maximum comfort in computer use: Like any other software vendor, Microsoft tries to make its products as accessible as possible. And in this case, Microsoft decided to enable Firefox users to use XAML browser applications.

As for the patch, it would have been better if Microsoft had informed Mozilla of the problem on the day of the release as a courtesy. This would have saved everybody a couple of days of back and forth, and the Mozilla folks from working the weekend to create a fix. The good news is that Mozilla and Microsoft managed to connect and hopefully established an ongoing collaborative partnership that will help address and resolve similar issues in the future.

By the way, this is all a moot point for organizations that patch vulnerabilities with an aggressive time line. After all, the MS09-054 fix addresses all known attack vectors for this vulnerability, so both IE and Firefox are protected. Once applied, it becomes unnecessary and maybe even inconvenient to have Firefox auto disable this plug-in. -- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: http://www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.