Firefox Blocks .NET and WPF

[manko]

I just opened Firefox to see this pop up:

Firefox has determined that the following add-ons are known to cause stability or security problems:

Microsoft .NET Framework Assistant 1.1

Windows Presentation Foundation 3.5.30729.1

I turned up this link which explains the situation:

Click-Once deployment suddenly stops working in FireFox


Official Mozilla Blog Post:

.NET Framework Assistant Blocked to Disarm Security Vulnerability

I do have the KB974455 hotfix installed on my systems, so the question is: should I re-enable either of these and if I do will Firefox just block them again? Or should I leave them off? Will leaving them off cause any problems with standard web browsing?

Does Mozilla contend that this vulnerability is still open even after the KB974455 hotfix?

 

[thedosbox]

Originally posted by: manko

I do have the KB974455 hotfix installed on my systems, so the question is: should I re-enable either of these and if I do will Firefox just block them again? Or should I leave them off? Will leaving them off cause any problems with standard web browsing?

Does Mozilla contend that this vulnerability is still open even after the KB974455 hotfix?

The problem is that Firefox has no way of telling whether the version you have was patched or not - hence the blacklisting.

If you're certain you have the hotfix applied, you can disable the extensions check: http://kb.mozillazine.org/Extensions.blocklist.enabled

 

[manko]

Thanks. I'm not sure I want to disable the check entirely, just for those two items. I haven't noticed any sites that don't work after disabling those two extensions. I guess I will leave them disabled unless I find a site that requires them for some functionality.

 

[thedosbox]

You may be able to bypass the blacklist for specific items in the near future: http://twitter.com/shaver/status/4973679315

Found via this thread on ars.

 

[Rangoric]

Originally posted by: manko
Thanks. I'm not sure I want to disable the check entirely, just for those two items. I haven't noticed any sites that don't work after disabling those two extensions. I guess I will leave them disabled unless I find a site that requires them for some functionality.

I don't think I've ever seen a website that needs them. I actually set WPF in a browser to off just because of that. People tend to use Silverlight/Flash instead since they are much more secure by default since (at least I know SL does) they are in a sandbox.