1256412 - uninstall.exe from the mozilla maintenance service does not have a valid digital signature

Status: RESOLVED INVALID

(Toolkit :: Application Update, defect)

Description

[patchwerk.git]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 20160303134406

Steps to reproduce:

Install Firefox 44 from: https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/en-US/

Navigate to ~\Program Files (x86)\Mozilla Maintenance Service\

Verify [Uninstall.exe] does not have a Digital Signature.


Actual results:

File does not appear to originate from Mozilla.org as it is not Digitally signed as other Firefox files.




Expected results:

File should be digitally signed as proof it is authentic.

Comment 1

[:Gijs (he/him)]

Benjamin, who could look at this in rstrong's absence?

Comment 2

[Benjamin Smedberg]

->mhowell, although it's possible this is something in releng signing

Comment 3

[Benjamin Smedberg]

Also unless there is evidence that this will result in a security exploit, we should open this up.

Comment 4

[Molly Howell (she/her) (mostly inactive)]

Can't blame RelEng for this one; the file isn't signed because it's generated by NSIS during installation of the service, not created at build time. This is standard practice for simple NSIS installers.

In my opinion this is not something we need to fix. The file can only be created inside Program Files, where it can only be written to by users with administrative privileges. Also, the installer that creates this file *is* signed. Those two facts combined mean that tampering with the code would be very difficult and probably not worthwhile for creating an exploit.
The only real defect is that the UAC prompt when you run the uninstaller says "Publisher: Unknown," and that in and of itself is not a security defect. It's not even a very serious cosmetic defect, because the maintenance service uninstaller is intended to be run indirectly by the uninstaller for the main product, and in that case that prompt is not shown.

Comment 5

[patchwerk.git]

(In reply to Matt Howell [:mhowell] from comment #4)
> Can't blame RelEng for this one; the file isn't signed because it's
> generated by NSIS during installation of the service, not created at build
> time. This is standard practice for simple NSIS installers.
> 
> In my opinion this is not something we need to fix. The file can only be
> created inside Program Files, where it can only be written to by users with
> administrative privileges. Also, the installer that creates this file *is*
> signed. Those two facts combined mean that tampering with the code would be
> very difficult and probably not worthwhile for creating an exploit.
> The only real defect is that the UAC prompt when you run the uninstaller
> says "Publisher: Unknown," and that in and of itself is not a security
> defect. It's not even a very serious cosmetic defect, because the
> maintenance service uninstaller is intended to be run indirectly by the
> uninstaller for the main product, and in that case that prompt is not shown.

Thank you for the explanation of why it wasn't signed.