Firefox disables Windows Add-on and Plugin

[Guest]

[Jose_Lisbon]

Today I got a pop-up from Firefox telling me it had to disable an add-on from Windows, wich it promptly did. But when I clicked on "more information" I got an error message.
I googled the situation but found nothing.
Anyone out there knows something about this?

Regards,
Jose.

[kail]

Yes, those MS add-on's were installed into Firefox without either the users or Mozilla's explicit permission/knowledge during a Windows Update some months back. They caused instant problems, both with their method of deployment and, in some cases, functionality. There was a large backlash on the Net. Later it was discovered that there were potential security risks as well and it didn't help that they were very hard to remove either. There was an even larger backlash on the Net and MS came under intense criticism for the whole debacle. Later MS agreed to remove/disable the add-ons, which is exactly what they did last Patch Tuesday. If you search the Net you should find loads of info on it.

edit: Incorrect statements removed. See below for update.

[Jose_Lisbon]

Thanks Kail.

[kail]

Correction: In the end it was Mozilla themselves that disabled those MS add-ons via their Add-ons Blocklist [mozilla.com]. I suspect Mozilla expected a little bit more from MS than just to "patch" the add-on vulnerabilities (which is what they actually did), like re-enabling the "Disable" and "Uninstall" buttons. Anyway, Mozilla advised [mozilla.com] MS in advance of their intentions and when MS agreed, they acted immediately.

[Jose_Lisbon]

Interesting reads those links. Thanks again Kail. Those add-ons should be uninstalled and not only disabled. But since 3.6 Beta is around the corner I won't worry about it.

Regards,
Jose.

[commanding the celsius]

Update (Sunday Oct 18, 6:30pm PDT): Microsoft has now confirmed that the Framework Assistant add-on is not a vector for this attack, and we have removed the entry from the blocklist. We are also working on a mechanism to allow Firefox users to re-enable the WPF plugin ahead of its eventual removal from the blocklist. For more information, see Mike Shaver’s latest blog post.

http://blog.mozilla.com/security/2009/10/16/net-framework-assistant-blocked-to-disarm-security-vulnerability/

I want it easily removed not the possibility to easy re-enable it.. 

[kail]

I'm still miffed that Windows Update added those two add-ons to Firefox in the first place. Makes you wonder what WU will do next without you knowing.

[kail]

Update: As you are probably now already aware.. everything changed over the weekend. I recommend reading The INQUIRER's take on this [theinquirer.net], mainly since (as usual) it's fairly funny.

[Tags:]