More information about the exploit can be found in this post on the FullDisclosure mailing list.
Update: The XPI to disable the pref is now available.
Another Update: mozilla.org has published a document on the issue.
Yet Another Update: There is an eWeek article about the exploit as well as a discussion at Slashdot. The now public bug report that covers the shell: vulnerability is bug 250180 (no unnecessary comments please). Some may find it notable that a patch was issued less than forty-eight hours after this bug was filed.
Yet Another Update: If you are not using Windows, you are not at risk from this bug. If you are using Windows, go to www.mccanless.us/mozilla/mozilla_bugs.htm to see if you are vulnerable.
It sounds like this is a perfect canidate for the new auto update feature.
I'm not so sure. :( Everyone that I know of that either upgraded or first-time installed Mozilla Firefox 0.9.x, I showed them how to disable the auto-update feature to prevent bugs.
I discovered two bugs while trying to set the preference mentioned.
1) When I typed "shell" into the Filter textbox and discovered that the pref did not yet exist, I tried to right-click to get a context menu so I could add the new pref. No context menu appeared! I later figured out that you need to actually right-click on an existing pref to add a new (unrelated) pref. This is bug 238955 <http://bugzilla.mozilla.org/show_bug.cgi?id=238955>.
2) When I added the new pref, I was using the filter "network.p". After adding the pref, it did not appear in the filtered list as it should have. I had to re-filter the list to get the new pref to show up. Can someone find the bug number for this?
this is why I love firefox...took no time at all to fix this. download of patch and applying it took seconds.
"this is why I love firefox...took no time at all to fix this. download of patch and applying it took seconds."
The only reason that you could do that was because the fix is a simple pref change. If it say, required a change to the way the core networking libraries operate, you'd likely be looking at a complete new build.
Hmmm ... I'm not so pleased. I, too, had thought to use about:config to reset the value and was surprised not to see it. I grant that it's nice that the xpi patches it so easily, but how many mainstream users come to Mozillazine.org every day? There ought to be a pop-up alert: Critical security update required, Download now! I also am troubled that new preference items can so easily be created in about:config . What prevents malware from creating a new entry expressly designed to open the door to an exploit?
How exactly does allowing a new preference to be created open the door to an exploit?
#7 What exactly do I need?
I noticed that the server directory from which I obtained this nightly has an xpi subdirectory, but I did not d/l anything from that subdir.
Does 0.9.2 by itself contain all the necessary security fixes, or do I need some of those xpi files? Do I still need the xpi file linked above ("XPI to disable the pref is now available") ?
0.92 disables the potential security problem.
OK, will 0.9.1 alert me when 0.9.2 comes out?? I had 0.9 & it never told me when .1 shipped..
This does seem like a huge issue though, does it actually run .exes or just download them?
"...which was found to enable pages to run executables on Windows via a link."
It does NOT download executables. However it apparantly allows someone to run an arbitrary executable, which is by itself already dangerous enough.
As for the auto-update not kicking in yet - it's obvious that it's still much of a work in progress, but that's what Firefox/Thunderbird are called 'preview releases' for. For Mozilla though, that's not much of an excuse. Then again, there's so many software around which doesn't have auto-update features, doesn't make them inherently bad. But, not real 'good' either, 'cause with browsers security is of course an important issue. Fortunately Mozilla is still the minority browser, so I doubt someone will actually exploit this security leak.
Note: setting the pref by hand fixes the issue _only_ for the current profile. So it's not a recommended way of fixing this. Use the XPI.
How do we install this for all profiles - extensions seem to install themselves in the profile anyway, don't they? Is there something special we need to do, or is this XPI specially configured to install into the program directory?
I'm using Firefox 0.9.1 on XP and cant get the patch to install. After clicking 'Install Now', the extension manager box appears but does not list shellblock. I've restarted and tried multiple times to no avail. Looks like it needs some work.
"After clicking 'Install Now', the extension manager box appears but does not list shellblock."
It doesn't appear in the Extensions window. Go to http://www.mccanless.us/mozilla/mozilla_bugs.htm to see if you're still vulnerable.
Well that is pretty bloody crap. For the average user, or even a power user, it is not immediately apparent that the security fix has been applied. The security fix should be listed in the extension manager.
When I go to another system running firefox I should be able to determine at a glance whether the fix has been applied, not follow a convoluted process.
Heh... It's not an extension.
Just go to about:config and see if network.protocol-handler.external.shell exists (and is set to false).
I figured this out, my point was that if we want Joe Blow to use Firefox and apply security fixes the process needs to be straightforward. Even if the XPI doesnt get listed in the extenstion manager (why not?) a dialogue confirming a successful patch would be useful.
On http://www.mccanless.us/mozilla/mozilla_bugs.htm the following link still shows (i didn't click it). "The following will accomplish the same as the above by using it as the source of an iframe. Click to show file"
I will admit that i just noticed that the XPI update was for Win XP &i'm using an older system than that... but does this mean that i'm still vulnerable?
#13 I don't understand the instructions.
Do I download 0.7.2 and 0.9.2 of TBird and FFox or do these patches or both?
#28 Re: I don't understand the instructions.
Either will fix the problem but because the fix is just a preference change it's easier to do the xpi installation and just restart the browser rather than have to reinstall the browser. I think they mainly released the new version for people who are going to install the program for the first time. Existing users don't need to go through the hassle just to effectively get a version change when you can get the fix with the xpi.
I just decided to finally update from 0.9 to 0.9.1, but much to my surprise, I downloaded 0.9.2 even though the firefox page hasn't been updated yet!
I went the route of installing 1.7.1 to resolve the problem. So far, the FTP site has no readme or other document detailing what's in this release. Anyone know if this is the only fix in 1.7.1, or if there is anything else?
That's the only fix. 1.7.1 is just 1.7.0 plus the fix and with a version number change.
There was work going towards a 1.7.1 with other fixes - that's still ongoing, and will presumably now be called 1.7.2.
I thought all they did was add shell: to a blacklist. How do you explain these bizarre file size differences?
I just read http://mozilla.org/security/shell.html and noticed, that it doesn't make clear, who is affected by the bug. As I can see from Bugzilla only Windows XP seems to be vulnerable. Could you please add that information to the website? It will be bad enough to read about that in the news, but it would be at least a bit less damaging, when stated, that only Win XP is affected.
I'm using Windows ME. When I tried the links off the mcanless.com test page, "shell:windows" did open my Windows directory. So I guess ME is affected in some way.
#19 Can you install shellblock.xpi on Older builds?
Like .7 or .8 etc? Thanks.
"Some may find it notable that a patch was issued less than forty-eight hours after this bug was filed."
... after the problem had been filed in 2002. Selectively leaving out the nasty bits?
It seems like that one is the root of all this.
"... after the problem had been filed in 2002."
There was no known exploit in 2002. A sample exploit was posted to Bugzilla on Wednesday 7th July 2004 at 6:46am Pacific Daylight Time. That's less than forty-eight hours ago. That said, I'm regretting adding the "less than forty-eight hours" part, particularly as I'm now fairly certain it should be "fewer than forty-eight hours".
"Less" is a better choice than "fewer" in this case. "Less" is for measurement. "Fewer" is for counting.
In this case we're talking about a measure of time, so "less than 48 hours" is correct (at least in American usage).
Time is continuous and uncountable so you have "less time"; however, in this case we're talking about hours, which are discrete and countable, so I think it should have been "fewer than forty-eight hours".
> "fewer than forty-eight hours"
You're trying to quantise time into hours - won't work!
You're talking about time, expressed in hours.
Looks like CERT has issued an advisory to immediately stop using FireFox and switch to Firebird.
Wouldn't systems vulnerable to this also be vulnerable using IE?
#33 How to change version # to 0.9.2?
Is this the preference setting for changing the version # to 0.9.2 after installing the xpi's----> general.useragent.vendorSub?
#39 Re: How to change version # to 0.9.2?
#46 When were you planning on telling me?
I downloaded 0.9.1 a few days ago, since I have heard about the flurry of security issues with IE. I just got around to installing it yesterday. I liked it. Lots of nifty stuff. I saw the extensions, and thought I'd browse around to see what all was there. Buried at the bottom was a security update(!). This is scarier than Windows. At least Windows tells me that a patch is available, I don't have to dig around. As the proverbial Joe Blow user, I think you need to consider some kind of automatic notification of security patches as a very high priority...if you guys can patch this in 24 hours, how long would it take to make something that checks a secured page at intervals to see if there are any critical issues or updates. Automatic updates might be harder to do, but something like this might do, in the meantime. I could find a patch, if I knew I should be looking for one.
#49 What is .xpi ?
Hi, We have an old system and we browse in superparanoid mode, for most part. So we never use Active-X and only use Java as required. So we do not even know what a file with extension .xpi is.
Can someone please enlighten us?
Also, isn't there some place in WINDOWS SYSTEM files where we can turn off this protocol, so that we are not vulnerable to this "shell" bug?
Will edit the prefs.js file as described.
Isn't there somewhere in WINDOWS itself where we can disable this shell: protocol handler? What does the average person use Shell: protocol for? If we do not use TelNet and similar programs, do we need shell?
Thanks in advance for any clarification anyone can provide.
#51 Windows 98 users are not affected?
Windows 98 users are not affected by the vulnerability.
So all that concern (about how to install the patch to close the security hole) was apparently for nothing!?
It would be useful if developers and security experts would remember that some of us 'Dinosaurs' out here still use OLDER programs--and at least mention those systems which are not in jeopardy when they publish these alarming vulnerability reports.