522981 - KB article: .NET Framework Assistant and Windows Presentation Foundation

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Articles, task)

Description

[[:Cww]]

In light of the recent blocklist see bug 522777, we need to have an article in the KB to explain the situation to users as well as what these extensions do and how to work around it if they really need this functionality.

Comment 1

[[:Cww]]

http://support.mozilla.com/en-US/kb/.NET+Framework+Assistant?bl=n is the first, still trying to figure out if there are any possible mitigating factors for the WPF one.

Sorry this took so long, the status of the blocklist kept changing so I had to keep updating.

Critical since this is hitting the press tomorrow morning.

Comment 2

[[:Cww]]

http://support.mozilla.com/en-US/kb/Windows+Presentation+Foundation?bl=n for the other one.

Comment 3

[Bo]

The important bits from the articles:

For .NET Framework assistant:
(1) A link to Microsoft's article on what the extension is for - ClickOnce (http://msdn.microsoft.com/en-us/library/142dbbz4.aspx).
(2) A note that "This extension was installed by Microsoft on some systems via a system update."
(3) How to disable the extension in Firefox
(4) Link to MS's article on uninstalling it (http://support.microsoft.com/kb/963707).
(5) "Due to a potential security vulnerability, the .NET Framework Assistant was recently blocklisted (link to http://support.mozilla.com/en-US/kb/Add-ons+Blocklist) by Mozilla. The security vulnerability has since been addressed. To re-enable the extension..."

For WPF:
(1) Link to MS's Technet article on the vulnerability (http://blogs.technet.com/srd/archive/2009/10/12/ms09-054.aspx)
(2) "Mozilla has added the plugin to the Add-ons blocklist (link to http://support.mozilla.com/en-US/kb/Add-ons+Blocklist), which disables it in Firefox."
(3) "Although the security vulnerability is fixed by Microsoft's MS09-054 (link to http://blogs.technet.com/srd/archive/2009/10/12/ms09-054.aspx) patch, Microsoft has requested that Mozilla keep the plugin blocklisted until a mechanism for distinguishing vulnerable versions from patched ones is found."
(4) Instructions for removal by renaming the associated DLL file.

Comment 4

[Dave Garrett]

WPF is under soft block now (bug 522975), so the option to override exists (either at time of block or thereafter). You'll probably want to update its article.

See also bug 523133 WRT soft blocking.

Comment 5

[[:Cww]]

Yep, already on it.  Thanks.

Comment 6

[[:Cww]]

Ok, new article is up.  Feel free to let me know if something looks off.

Comment 7

[Dave Garrett]

Couple of minor notes:
1) In the .NET article "recently blocklisted by Mozilla" might be better as "recently temporarily blocklisted by Mozilla" to note that it was only blocked for a few days and is off now.
2) The removal instructions on the WPF page should probably be put down further on the page, maybe just after "Disabling via the add-ons manager" and renamed to "Disabling manually" ("removal" implies deleting the files). There's not much of a benefit to the given removal method over just disabling.

Comment 8

[Chris Ilias [:cilias]]

Dave, are you registered on support.mozilla.com?
If not, see <http://support.mozilla.com/tiki-register.php>. The knowledge base is a wiki, so you can edit the pages if you seen any mistakes. For instructions see <https://support.mozilla.com/en-US/kb/Editing+articles>.

We mainly use Bugzilla for tracking article requests. Once the article is approved and in the KB (verified fixed), there is no need to comment on the bug anymore. We have a Contributors forum at <https://support.mozilla.com/en-US/forum/3>.

Thanks for your help.

Comment 9

[Dave Garrett]

I wasn't aware of the process so I just commented here instead. I've made the changes and will just make them myself next time, then. Thanks.

Comment 10

[Chris Ilias [:cilias]]

Awesome, thanks!