300840 - Page suggests I download vulnerable 1.0.4 (localizations lag)

Status: RESOLVED FIXED

(www.mozilla.org :: General, defect)

Description

[Jim Ley]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Build Identifier: 

Upon visiting http://www.mozilla.org/products/firefox/ the page suggests I 
download the 10.0.4 British English version rather than a 10.0.5 - Given that 
10.0.4 is vulnerable to published security flaws it should not be offered for 
download ostensibly as the up to date version.

Reproducible: Always

Steps to Reproduce:
1. Configure Accept-Language to something other than en, e.g. en-GB
2. Visit http://www.mozilla.org/products/firefox/
3. See the 10.0.4 download prompt



Expected Results:  
Only 10.0.5 versions should've been available.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It's offering both en-US 1.0.5 and en-GB 1.0.4, right?  That's what I intended
it to do, anyway.

For en-US and en-GB, there might be an argument the other way, but for somebody
who doesn't speak English (i.e., for most other cases), we probably do want to
offer the 1.0.4.  Localized versions should be available soon, anyway.

Comment 2

[Jim Ley]

You should not be offering versions vulnerable to published flaws available for 
download other than in an archive area full stop.

I read about the flaws in bugtraq, I visited the download page, and unless I 
specifically knew the latest version was 1.0.5, I would've then continued to 
download the prompted version and felt I was up to date and therefore safe.

The continued recommendation of vulnerable versions will leave people unsafe.

As you say regionalised versions come along very soon after, so I do not feel 
users would be overly inconvenienced by not having a version available to them, 
or have the regionalised version only available after a very strong warning 
that it is insecure.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

What really should happen, IMO, is that we shouldn't publish the security
advisories until we have localized versions available for download.

Comment 4

[Jim Ley]

True, that would indeed make sense, and be a perfectly good other approach to 
fixing the bug - and probably a better one, but given that they have, it would 
be nice not to have it as a problem.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Well, if someone else wants to make the necessary changes to the script, test
them on Gecko, WinIE, Safari, MacIE, Netscape 4.x, and Konqueror, land them, and
then back them out in a few days, feel free, but I have no plans to do so.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

...and Opera.  I knew I was forgetting one.

Comment 7

[Daniel Veditz [:dveditz]]

(In reply to comment #3)
> What really should happen, IMO, is that we shouldn't publish the security
> advisories until we have localized versions available for download.

Please tell that to the people beating down my door because I published them so
*late*!

Man, can't win.

Comment 8

[Daniel Wang]

fixed by dbaron%dbaron.org on 2005-07-19 16:45