Mozilla Firefox blocks Microsoft Plugins

I was suprised earlier today when I found that Firefox was coming up with some rather strong warning messages about Microsoft plugins.

According to LifeHacker Microsoft issued “a high-priority security” patch for its .Net Framework Assistant and Windows Presentation Foundation extensions for Internet Explorer, and the extensions were also added to Mozilla’s block-list to make sure FireFox users were protected from harm. As a result, users this morning received the error message above when they started up FireFox.

The security threat used XAML Browser Applications on malicious websites to exploit a weakness in WPF (Windows Presentation Foundation) plug-ins. This type of attack is known as a “browse and get owned” or “browse once and own” attack. This type of security compromise is especially frustrating for victims as it requires no further action from the victim after the website has been accessed for the attack to occur. According to LifeHacker the plug-ins may have been removed from Mozilla’s blacklist after it was determined that a “browse once and own” threat didn’t exist.

For full removal instructions for these plugins, please see the Microsoft Technet website:

http://blogs.technet.com/srd/archive/2009/10/12/ms09-054.aspx