Where the story gets interesting is that the patch for this vulnerability (MS09-054) was issued via Windows Update by Microsoft on 14 October 2009.  So, two days after the patch for this issue was delivered via automatic updates, Mozilla decided that it would be a good idea to disable these add-ons.  Unfortunately, the block list technology Mozilla has put into place in Firefox does not give the user any option to override a block other than turning off blocking completely.

When bringing this up on the BugZilla thread for this issue, the members of the team responsible for issuing this block essentially have said that they do not plan on removing the block, putting thousands of developers using ClickOnce for distribution of their software in the position of not being able to effectively deliver their software to Firefox users.

“Updates are not magic. Some people have them now; some don’t. If it’s not 100% then it’s vulnerable and hence the block. If a version that is 100% (preferably with user permission) were put out then that could be allowed, as already stated,” stated Dave Garret. “Fundamentally, Microsoft introduced a security risk into Firefox with these add-ons. That risk came to fruition and thus Mozilla closed the risk entirely.”

Although the issue was not with the add-ons themselves, the Mozilla team apparently is refusing to unblock them until new versions of the add-ons are released that are not vulnerable.  The funny thing is, the current versions of the add-ons are not vulnerable.  It seems as though the few people who are making the decision about this block may have decided to take advantage of this opportunity to block a set of add-ons that have been controversial.

This is bad news for software developers and many enterprises who use the ClickOnce technology to deliver applications to their users.  It’s especially bad news for Mozilla, in my opinion, because if this block isn’t removed, those enterprise IT organizations who managed to get Firefox approved as their standard browser may be forced to switch back to Internet Explorer.

Hopefully someone with some sense will step in and realize that this block needs to be removed.

More information:
http://csharpner.blogspot.com/2009/10/firefox-has-determined-that-following.html