662309 - (CVE-2011-3666) .jar should be marked executable

Status: VERIFIED FIXED

(Core Graveyard :: File Handling, defect)

Description

[Daniel Veditz [:dveditz]]

+++ This bug was initially created as a clone of Bug #657462 +++

If Java is installed "opening" a .jar file will launch a Java Application, which is definitely not 'web safe'. Since a .jar application can launch executables (among other things) we should mark that as an executable type so that users are forced to download and manually open rather than allow then to open from the download prompt (or worse, set it to auto-open).

We should check to see if Java registers any other extensions while we're at it.

Comment 1

[LegNeato]

Dan, we'll need a reviewed patch for this by 2:00 pm PDT tomorrow...

Comment 2

[Daniel Veditz [:dveditz]]

Attachment: Add .jar and .air to Windows executable list

Require Java and Air bundles to be downloaded and manually run like other executable types.

Comment 3

[Daniel Veditz [:dveditz]]

http://hg.mozilla.org/mozilla-central/rev/827d5938a23e

Comment 4

[Daniel Veditz [:dveditz]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/3fcfddba021b

Comment 5

[Johnny Stenback (:jst)]

Pushed to beta:

http://hg.mozilla.org/releases/mozilla-beta/rev/80d99dbc8e9e

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Can someone be super explicit on the testing scenario / STR for QA here? :-)

Comment 7

[:Gavin Sharp [email: [e-mail]]]

The testcase in bug 657462 is one way to test (that specific example should be mitigated by this fix).

Comment 8

[:Gavin Sharp [email: [e-mail]]]

Another more general way to test is to ensure that the Download Manager warns you with the scary prompt before allowing you to double-click-open downloaded .jar/.air files.

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Gavin, the testcase in bug 657462 still exhibits its bug with last night's 1.9.2 build (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18pre) Gecko/20110607 Namoroka/3.6.18pre (.NET CLR 3.5.30729)) so this fix doesn't address that.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

I downloaded a .jar file from https://github.com/nzakas/cssembed/downloads/ with last night's 1.9.2.18pre build on XP (same one as comment 9) and double-clicking in the download manager briefly shows an hourglass, which then dismisses. Nothing else happens and no additional program opens or prompts.

Comment 11

[:Gavin Sharp [email: [e-mail]]]

Didn't this land earlier today? Last night's 1.9.2 build wouldn't have the fix.

Comment 12

[Al Billings [:abillings - ex-MoCo]]

I see the warning now in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18pre) Gecko/20110609 Namoroka/3.6.18pre (.NET CLR 3.5.30729).

Verified for 1.9.2.

Comment 13

[LegNeato]

http://hg.mozilla.org/releases/mozilla-beta/rev/4bde5f7cea8f

Comment 14

[Daniel Veditz [:dveditz]]

The June m-c landing means this is fixed in Firefox 7, too

Comment 15

[u279076]

qa+ for QA fix verification on Firefox 7.

Comment 16

[u279076]

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0) Gecko/20100101 Firefox/7.0 ID:20110922153450

1) https://github.com/downloads/nzakas/cssembed/cssembed-0.4.0.jar
2) http://cloudfront.ambiance.urbanapps.com/airinstaller/Ambiance.1.0.2.air

Both files ask me to save the file first. Once downloaded, when I double click them in the Download Manager they open in their respective apps without warning:

* .jar opens in WinZip
* .air opens in Adobe Air Installer

Is this the expected result?

Comment 17

[Al Billings [:abillings - ex-MoCo]]

As I recall, once it is downloaded, it is treated as any other downloaded file. The fix is to make sure that your only option is to save the file when you are prompted to download it.

From your description, Anthony, this sounds fixed.

Comment 18

[u279076]

Thanks for the clarification, Al. Marking verified fixed.

Comment 19

[Daniel Veditz [:dveditz]]

The description of CVE-2011-2372 matches bug 657462 as announced in MFSA 2011-40 so we should stick to that. This one is now CVE-2011-3666