828982 - Plugin block request: Foxit Reader Plugin 2.2.1.530 and below due to critical vulnerability

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[[:philipp]]

according to reports the foxit pdf browser plugin is affected by a highly critical vulnerability which can be exploited to inject malicious code:
www.h-online.com/security/news/item/Current-Foxit-Reader-can-execute-malicious-code-1780636.html

please consider blocking it up to the latest plugin version 2.2.1.530 in order to protect users...

Comment 1

[Scoobidiver (away)]

philipp, you should have used the link in https://wiki.mozilla.org/Blocklisting#How_to_request_a_block

Version 2.2.1.530 is the current version.

Plugin name: Foxit Reader Plugin
Plugin versions to block: 2.2.1.530 and below
Applications, versions, and platforms affected: Windows
Block severity: (hard/soft)

How does this plugin appear in about:plugins?
    File: npFoxitReaderPlugin.dll
    Version: 2.2.1.530
    Description: Foxit Reader Plug-In For Firefox and Netscape

Homepage and other references and contact info: http://www.foxitsoftware.com/Secure_PDF_Reader/

Reasons: http://secunia.com/advisories/51733/

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Staged: https://addons-dev.allizom.org/en-US/firefox/blocked/p263

It is currently staged as a CTP block, but I'm not sure if this is the right UX to provide in this case. I don't know if the PDF download will be triggered, or if the CTP UI will appear. If it doesn't, maybe we should go for a softblock.

Comment 3

[Benjamin Smedberg]

The desired UI is the CTP block. I believe it should work, but QA should verify before we push this live.

Comment 4

[juan becerra [:juanb]]

I've tested this on staging. The block is CTP. When I try to open a PDF file I get the page showing the lego piece and the message saying the plugin has vulnerabilities. About:addons shows the plugin as enabled, but it shows the message that it is known to be vulnerable and to use with caution. If I click through it I can see the document.

We can move to production when you are ready.

Comment 5

[juan becerra [:juanb]]

Attachment: CTP Foxit Reader Plugin

Comment 6

[Alex Keybl [:akeybl]]

Let's give people on the [e-mail] mailing list an hour or two to respond with any last minute issues, and then move this to production.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

The block is now live: https://addons.mozilla.org/en-US/firefox/blocked/p250

Comment 8

[juan becerra [:juanb]]

This has been verified on production.