From the “Browser Security” files:
Over the weekend, potentially tens of millions of users around the world booted their Firefox browser and were told that their Microsoft add-ons were being blocked (see my screenshot, left).
Specifically, Mozilla began blocking the Windows Presentation Foundation (WPF) add-on and the .NET Framework Assistant add-on. Both of those add-ons were added to Mozilla’s blocklist for security issues.
Late Sunday, Mozilla VP Mike Shaver blogged that the .NET Framework Assistant add-on is now set to be removed from the blocklist but the WPF framework would stay on the list.
“We received confirmation from Microsoft this evening that the Framework Assistant add-on is not a mechanism for exploiting the vulnerabilities detailed in the earlier post, so we’ve removed it from the blocklist,” Shaver wrote. “As the blocklist update propagates to clients, the add-on should be re-enabled for users who had it previously enabled.”
As of 9 AM EDT today, I still see both Microsoft add-ons on the blocklist as published by Mozilla at https://www.mozilla.com/en-US/blocklist. I’m not sure how long it takes to change a Web page, let alone propagate a change to tens of millions of users.
The reason why Mozilla is blocking the Microsoft add-ons in the first place is because during this month’s Microsoft Patch Tuesday update, the two add-ons were identified as being risky.
Next page: A messy approach — and a secure one?
