250893 - July 8, 2004 shell.html security patch installation crashes Windows 98SE OS

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[finkey]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a1) Gecko/20040520
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a1) Gecko/20040520

ref: http://www.mozilla.org/security/shell.html and
http://ftp.mozilla.org/pub/mozilla.org/mozilla/releases/mozilla1.7.1/shellblock.xpi

After installation of patch above, and closing Mozilla browser, on restart of
browser, system frozw, screen blacked out, then, on restart of PC, Windows froze
on boot-up, showed desktop with no taskbar.  Had to remove Mozilla in safemode.
 Reinstalled Mozilla browser without patch to submit this report.

Reproducible: Always
Steps to Reproduce:
1. On Windows98SE PC, install latest beta Mozilla browser complete.
2. Install security patch from
http://ftp.mozilla.org/pub/mozilla.org/mozilla/releases/mozilla1.7.1/shellblock.xpi
3. Close browser then try to reopen it.
4. Restart PC.

Actual Results:  
System crash.  Then, Windows98SE OS cannot boot up beyond secondary display.  No
task bar.  After safemode removal of Mozilla, system normal.

Expected Results:  
Normal op.

Using classic.  No messages. Just crash, black screen, no boot.  Shell security
affected Windows OS shell.

Comment 1

[Andreas Kunz]

Well, all this patch does is copying the file "bug250180.js" into the default
pref directory in the Mozilla application directory.
And this file is just a text file with two lines for the added preference:
   // block shell: protocol handler (bug250180)
   pref("network.protocol-handler.external.shell", false);

So how, please, can this text file prevent your system from booting??

Did you have Quicklaunch on? (so Mozilla loads into memory on startup)

Comment 2

[Hermann Schwab]

I lost my bookmarks when I quickly wanted to install the patch on my Win98SE
system. But as i´ve got lots of Mozillas and lots of profiles, and didn´t
restart the patched 1.7, but a current nightly 1.8a2, I thought it to be my fault.
Then, after work, I patched a Win98 system, and all was well, though I had to
wait some more time for the Personal Toolbar to show my huge bookmarks folders.
And no, I never use quickstart for browser (Netscape/Mozilla/Firefox). But I got
OpenOffice as quickstart, could this be the culprit?

Comment 3

[finkey]

(In reply to comment #1)
> Well, all this patch does is copying the file "bug250180.js" into the default
> pref directory in the Mozilla application directory.
> And this file is just a text file with two lines for the added preference:
>    // block shell: protocol handler (bug250180)
>    pref("network.protocol-handler.external.shell", false);
> 
> So how, please, can this text file prevent your system from booting??
> 
> Did you have Quicklaunch on? (so Mozilla loads into memory on startup)

No, I don't have Quicklaunch on.  Does the patch "workforme" for other users of
Win98SE?
> 

Comment 4

[Andreas Kunz]

I asked the quicklaunch question because as I said the patch only adds a text
file to the Mozilla application directory and I therefore cannot imagine how it
should prevent your Win98 from booting when Mozilla is not even started at bootup!
Personally, I highly doubt the patch has the power to cause your problems...