621623 - Unable to download files when IE security settings cranked up to "high"

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Prasenjeet Dutta]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13

Following a Remote Code Execution Vulnerability in Internet Explorer, Microsoft issued two workarounds in Security Advisory 2488013. One of these (the more practical one for home users who can't completely ditch IE) is to crank up IE's security settings.

Unfortunately, because the browser.download.manager.skipWinSecurityPolicyChecks setting has been removed from Firefox 3.6, following Microsoft's security advice now means that downloads in Firefox stop working.


Reproducible: Always

Steps to Reproduce:
1. Open IE options and go to the Security tab. (Start > Settings > Control Panel > Internet Options > Security tab)
2. Follow Workaround #2 in Microsoft Security Advisory 2488013 and set Internet and Local Intranet Security Zone settings to "high".
3. Open Firefox.
4. Download any EXE file.

Actual Results:  
The download manager shows "Cancelled" and a zero byte file is created.

Expected Results:  
The file would be downloaded.


The alternatives for such home users are to futz around with the registry or the Custom Security Level dialog in IE or  use another browser like Chrome or Opera.

Please consider reinstating the skipWinSecurityPolicyChecks setting. See comments like https://bugzilla.mozilla.org/show_bug.cgi?id=445158#c58 for how a lot of users feel about this.

Comment 1

[Jo Hermans]

see bug 504804 comment 31 and below.

You can disable anti-virus scanning by setting
browser.download.manager.scanWhenDone to false, that will fix the problem. Bug 509713 will make it easier in the UI.