Remember that Microsoft .NET Framework Assistant add-on that Microsoft sneaked into Firefox without explicit permission from end users?
Well, the code in that add-on has a serious code execution vulnerability that exposes Firefox users to the “browse and you’re owned” attacks that are typically used in drive-by malware downloads.
The flaw was addressed in the MS09-054 bulletin that covered “critical” holes in Microsoft’s Internet Explorer but, as Redmond’s Security Research & Defense team explains, the drive-by download risk extends beyond Microsoft’s browser.
Now, Microsoft’s security folks are actually recommending that Firefox users uninstall the buggy add-on:
For Firefox users with .NET Framework 3.5 installed, you may use “Tools”-> “Add-ons” → “Plugins”, select “Windows Presentation Foundation”, and click “Disable”.
…not mentioning here that Internet Explorer doesn’t need those add-ons, as it uses their native counterparts directly in Windows ;D …being as much a source of vulnerabilities as their sisters add-ons…for Firefox …also, the MS add-ons were installed silently, like the worse spyware add-ons do when you get them else where than here: https://addons.mozilla.org/en-US/firefox/ …just this time, the culprit was Microsoft, attempting shamelessly to render Firefox as vulnerable as IE is and always was. I have found these MS ad-ons and plugins a while ago, and didn’t wait for MS to broadcast anything before I removed them.
I don’t know why Microsoft do it with the programs which is not “Microsoft Product”, personally I think (if we ignore Microsoft name) it’s a suspicion behavior!
we install Firefox because we don’t like Microsoft product, so why we should have it in there? it must change to an optional component.
exactly; Firefox was just meant to avoid all the vulnerabilities affecting Internet Explorer, and as far as I know the operation was successful. Add-ons can still be installed silently - from bad sites - so let’s not forget that. And Microsoft attempt to “infect” Firefox with .net stuff etc…, using the same technique as the “bad guys” do, is very regrettable.
I don’t bash Windows nor Microsoft in a general way, but this "incident " was unacceptable.
edit: those MS plugins and add-ons would be of no use for most internet users, so even as an option wouldn’t make sense.
@Logos: it seems at least I found one person here who has a mind like mine about computer software! ;D
well, it has not been happened for me, at least since I know it’s not possible to install add-ons from web without confirm. but yeah, that’s right when you run a program (as administrator privileged Vista/7) it can install add-ons without your confirm and it’s lake of security for Mozilla company product.
even if it be useful only for one person, it would not hurt to have it in Mozilla Add-on sites to install on user request. don’t be cruel to Microsoft ;D
it’s actually two different techniques: on one side MS installing silently an FF add-on, bypassing (of course ;D ) UAC. Firefox cannot stop this, that’s impossible, it’s a browser, not a HIPS
And on the other side bad sites doing the same silently too, but from the web. This was obviously more likely to happen when Firefox (until 2.0) didn’t have anything to react against this like a warning dialog like now. It has happened to me ;D, with FF 1.5 or 2.0 I can’t remember. I found out when watching my firewall and then the extension list. I complained about it on Mozilazine forums, and they answered then that Firefox couldn’t prevent these sort of attacks, and that it didn’t have to, that I was responsible for visiting a bad site. Funny how a couple of versions later they introduced the protection we know ;D
I started Firefox an about 10 minutes later a message popped up, telling me,
Windows Presentation Foundation 3.5.30729.1 (Plugin)
Microsoft. Net framework assistant 1.1 (Extention)
Has been blocked because of stability and security, and for Firefox to be restarted. The wording was different but i can not remember fully, what it said.
So they are still there but have been blocked, Disabled .
.NET Framework Assistant Blocked to Disarm Security Vulnerability
I probably won’t get that message, Pete. I uninstalled Microsoft. Net framework assistant quite a while back using instructions in the MS knowledge base. I noticed the Windows Presentation Foundation one time when I was reviewing the list of plugins Firefox was using. I disabled it immediately.
I’m glad to hear Firefox has taken the initiative to block those two problematic add-ons.
it’s not about your computer overall security (might have other flaws than this ) it’s about the rest of your system being safe from flaws coming from MS extensions in Firefox. The answer is: yes, normally, yes. With IE there’s no fix ;D …except not using it.
if you don’t have them, it’s mean you have not installed .Net Framework +3, don’t worry, it’s okay, just for some new programs you may get a warning that they need it to run.
if you buy songs from a location which need these (or use some stuff else which need it), no, don’t disable, but if not, you can disable them and re-enable them when you need them.
…also, the MS add-ons were installed silently, like the worse spyware add-ons do when you get them else where than here: 
;D