Perimeter
10/22/2009
08:55 AM
Wolfgang Kandek
Wolfgang Kandek
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Microsoft And Mozilla Compete, Cooperate

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.

In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.The patch for MS09-054 Cumulative Security Update for Internet Explorer addressed four critical vulnerabilities in Microsoft's Internet Explorer for all versions in all underlying Windows operating systems. However, one of the vulnerabilities also impacted Firefox, the competing open-source browser developed by the Mozilla Foundation, and considered by many security experts a safer alternative than IE.

How could this happen? Is something sinister going on?

In Microsoft's .NET Framework 3.5 SP1, the runtime libraries needed to execute code developed under Microsoft's .NET installs for a plug-in called Windows Presentation Foundation in Firefox that enables the browser to execute XAML browser applications similar to the corresponding component in IE. This plug-in then serves as a conduit to the underlying flawed Windows component -- and, in effect, makes Firefox vulnerable to this attack.

Once the issue was raised by the press, Mozilla acted fast, pushing out a fix that disabled both the plug-in in question and also the .NET Framework Assistant plug-in. It turns out that disabling the second plug-in was an overreaction, which Mozilla has since fixed.

Both Mozilla and Microsoft published details and a time line of the issue in their blogs, and there is an update in the FAQ section of MS09-054 with further details.

Nothing sneaky went on here, and there's no conspiracy. It's just about striving for maximum comfort in computer use: Like any other software vendor, Microsoft tries to make its products as accessible as possible. And in this case, Microsoft decided to enable Firefox users to use XAML browser applications.

As for the patch, it would have been better if Microsoft had informed Mozilla of the problem on the day of the release as a courtesy. This would have saved everybody a couple of days of back and forth, and the Mozilla folks from working the weekend to create a fix. The good news is that Mozilla and Microsoft managed to connect and hopefully established an ongoing collaborative partnership that will help address and resolve similar issues in the future.

By the way, this is all a moot point for organizations that patch vulnerabilities with an aggressive time line. After all, the MS09-054 fix addresses all known attack vectors for this vulnerability, so both IE and Firefox are protected. Once applied, it becomes unnecessary and maybe even inconvenient to have Firefox auto disable this plug-in. -- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: http://www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.