MS09-054: IE and Firefox Attack Surface

The Security Research & Defense blog provided additional information on the attack surface for the IE Security Bulletin MS09-059, Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (975467). As explained:

“A browse-and-get-owned attack vector exists. All that is needed is for a user to be lured to a malicious website. Triggering this vulnerability involves the use of a malicious XBAP (XAML Browser Application). Please not that while this attack vector matches one of the attack vectors for MS09-061, the underlying vulnerability is different. Here, the affected process is the Windows Presentation Foundation (WPF) hosting process, PresentationHost.exe.

While the vulnerability is in an IE component, there is an attack vector for Firefox users as well. The reason is that .NET Framework 3.5 SP1 installs a “Windows Presentation Foundation” plug-in in Firefox”

In other words, if you happen upon a malicious website, with the Windows Presentation Foundation (WPF) plug-in enabled in Firefox, your computer is vulnerable.

Recommendations:

Internet Explorer

Although XBAP is disabled in IE8 on Win2k8 and Win2k3, that is not the case for IE7 or other operating systems. To disable this setting, edit the security settings in the Internet Zone as follows:

Launch Internet Explorer --> Click Tools --> Security Tab --> in Internet, click Custom level. Under .NET Framework --> XAML browser applications, Change the setting to Disable:

Firefox:

The WPF plug-in was installed in Firefox with .NET Framework 3.5. To disable the plug-in, do the following:

Click Tools --> Add-ons --> Click the Plugins Tab.
Select “Windows Presentation Foundation”, and click “Disable”.

To uninstall the “Windows Presentation Foundation” plug-in from Firefox, see to Microsoft KB Article 963707, How to remove the .NET Framework Assistant for Firefox.

References:

• Microsoft KB Article 963707, How to remove the .NET Framework Assistant for Firefox
• Security Bulletin MS09-059, Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (975467)
• Security Research & Defense: MS09-054: Extra info on the attack surface for the IE security bulletin
• ZDNet.com: Microsoft exposes Firefox users to drive-by malware downloads

Clubhouse Tags: Clubhouse, IE8, IE7, Firefox, Internet Explorer, Tips, Security, Windows Vista, Windows 7, Information, How-To

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...