Microsoft Add-On for Firefox a security issue

Back in February of 2009, Microsoft released a very sneaky and quiet update to Windows. The update was a firefox add-on that was added automatically. It’s labelled ‘Microsoft .NET Framework Assistant,’ and it ‘Adds ClickOnce support and the ability to report installed .NET versions to the web server.’

No big deal right? I’ll just uninstall it or not install it. Nope! Big Deal! The problem is that the add-on cannot be uninstalled the normal way. The button to unistall or disable it is grayed out.

Instant questions came to mind: Is it messing with other settings in firefox? Is it reporting back to MS what other extensions I am using? Is it monitoring my web traffic? Will it break my browser? And lastly, is this a new security problem?

Turns out that indeed it is a security hole in firefox.

Back in February, there was an instant fix on how to uninstall this add-on. You can get instructions at www.dedoimedo.com But now firefox has tried to help fix the problem for you.

You’ll see that after disabling it, a restart of firefox will remove it from the add-ons.

If you do not already have Firefox 3.5 I suggest you upgrade. Get firefox from their website.