Firefox gets emergency update to fix the last update

Summary: It looks like last week's automatic update to Firefox came with an unintended hitchhiker: a new bug that opened up a potentially critical security vulnerability. The Mozilla Foundation responded by pushing out a new update that fixes the problem:MFSA 2009-23 Crash in nsTextFrame::ClearTextRun()I found the time line on this one interesting so I thought I'd share it.

By Ed Burnette for Dev Connection | April 28, 2009 -- 15:51 GMT (08:51 PDT)

Follow @eburnette

It looks like last week's automatic update to Firefox came with an unintended hitchhiker: a new bug that opened up a potentially critical security vulnerability. The Mozilla Foundation responded by pushing out a new update that fixes the problem:

MFSA 2009-23 Crash in nsTextFrame::ClearTextRun()

I found the time line on this one interesting so I thought I'd share it. It provides a fascinating insight into Mozilla's around-the-clock development process (all times are PDT):

April 21:

5:11am: Marc Gueury, who was running a pre-release version of Firefox, noticed a new crash when using the HTML Validator extension (bug 489322). As more people started running into it, one noted:

Firefox 3.0.9 downloaded in the background and installed when I restarted. Ordinarily I think that is a brilliant thing, but this time, because of this bug, it's corrupting my ability to work.

April 22:

1:06pm: Daniel Veditz noticed a new "topcrash" and filed bug 489647. Topcrashes are like Firefox's equivalent of a "Top 10 list" from the automatic crash reporter.
1:16pm: Developers narrowed down the time frame of the regression and identified a couple of possible pushes that might have caused it.
11:17pm: The exact problem was described. Essentially, a fix to one problem got tangled up in a fix to another problem, which resulted in an incomplete patch being applied.

April 23:

3:46am: A test case was created.
3:52am: A patch was created to fix the bug.
10:20am: The patch was checked into source control.
12:30am: The fix was approved for an emergency release.
5:04pm: The bug fix was verified on 3.0.10 builds on Linux.
11:52pm: The bug fix was verified on 3.0.10 builds on Windows.

Once the fix was approved and verified the process of pushing out a new automatic update was started.

Topic: Browser

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

25 comments

Log in or register to join the discussion

Fixed ! Open Source in Action......

Open Source fixed it...

Christian_<><
28 April, 2009 17:52

Reply Vote
- No, actually Mozilla quality control blew it
 
 Seriously. Rather than rush fixes through maybe
 - just maybe - they should take some more time
 to properly test their changes.
 
 I mean, it is not like this was only triggered
 in some obscure, intricate scenario. It was
 reported by multiple users within hours of the
 3.0.9 release. I know they are the heroes and
 all, but seriously!
 
 Nobody can write completely bug-free code, but
 if you create a culture where you always value
 speed over quality, this is going to happen
 again, again and again. And these bug just seem
 so easy to trigger that a properly designed
 test suite should have caught them.
 
 There is a reason Firefox is now the
 browser with the most vulnerabilities,
 an honor which used to belong to IE6 back in
 the day.
 
 And it's not just the introduction of new
 vulnerabilities that should be a cause for
 concern. Firefox is also the most buggy browser
 overall. And that's a problem as more and more
 organizations are relying on the browser as a
 platform for in-house mission critical
 applications. Bugs which may be a minor
 nuisance to most of us may be devastating for a
 company whose applications trigger it.
 
 Microsoft gets this. And they have improved
 vastly over the latter years. Firefox is now in
 the same league. They can no longer just be the
 smart, agile kid who can afford a few missteps.
 
 honeymonster
 28 April, 2009 22:24
 
 Reply Vote
 - Utter rubbish.
 
 "Microsoft gets this".
 
 That would explain Vista right? Duh!
 
 fr0thy2
 29 April, 2009 01:44
 
 Reply Vote
 - Re:
 
 No, that explains Windows 7...
 
 dvm
 29 April, 2009 04:59
 
 Reply Vote
 - Explain this then....
 
 http://windows7center.com/news/security-research-team-find-unfixable-windows-7-hack/
 
 Alan Smithie
 29 April, 2009 04:15
 
 Reply Vote
 - Re:
 
 From what I read, the hack doesn't work if the volume is encrypted (BitLocker) + have a TPM solution. So, it's not "unfixable".
 
 dvm
 29 April, 2009 05:08
 
 Reply Vote
 - The solution is worse than the cure
 
 Do you know what a TPM module is? It's pretty much the worst thing ever to happen to computing. It's a hardware-based "security" chip whose security implications are absolutely nightmarish. It protects your computer from what someone else defines as security violations (the computer owner gets no say in the matter) by using strong encryption that the computer owner does not actually have the key to. The whole system is heavily dependent upon Internet access and Internet validation against remote servers? What does this mean?
 
 Simply put, the owner is no longer ultimately in control of his computer if there's a TPM chip installed and active. You think the thought of Iran and North Korea getting nuclear weapons is scary? Let me paint a more realistic scenario for you.
 
 While the rest of the world puts pressure on those two rogue nations and manages to keep traditional WMDs out of their hands, Iran manages to place one single spy in the right program at Microsoft. Meanwhile, TPM chips, marketed as a feature that makes your computer more secure, become as ubiquitous in 10 years as GPUs are today.
 
 Now 99% of existing computers have an Internet-based security system in them, and Iran has the key, a metaphorical "big red button" that would shut down every computer in the United States, doing more overall damage than a nuclear explosion in one of our cities.
 
 This is some very evil technology, and it needs to be banned by law, not welcomed as the solution to security problems.
 
 masonwheeler
 29 April, 2009 13:32
 
 Reply Vote
 - Hardly
 
 TPM is not what it used to be...
 
 http://www.informationweek.com/news/security/encryption/showArticle.jhtml?articleID=208800939&pgno=1&queryText=&isPrev=
 
 JoeMama_z
 30 April, 2009 15:50
 
 Reply Vote
 - Wow are you desperate. From the article:
 
 "Fortunately for users, this hack cannot be done remotely and requires physical access to a PC."
 
 ye
 29 April, 2009 05:19
 
 Reply Vote
 - You have to have physical access
 
 It's not terribly difficult to hack most OS'es with physical access to the equipment. What they don't mention is this is useless against a PC that's on a domain. It changes the local SAM password but does nothing to domain credentials. Which means you still wouldn't be able to access network resources.
 
 LiquidLearner
 29 April, 2009 07:44
 
 Reply Vote
 - For the moment, yes...
 
 What happens when someone manages to combine this with another exploit that allows them to remotely plant it on someone's computer? Just because nobody's thought of a way to do it yet doesn't mean it's impossible.
 
 masonwheeler
 29 April, 2009 13:50
 
 Reply Vote
 - RE; Explain this then....
 
 If I have physical acces to your box I will be able to get in regardless of OS.
 
 Col Mustard
 29 April, 2009 13:46
 
 Reply Vote
 - So wrong.......
 
 Again, you are so quick to jump on a one time occurrence and conveniently forget that Microsoft has done this same trick many times.
 
 For example, the code red patch for exchange servers took 3 fixes to their patch right when the first patch took down exchange servers all over!
 
 But you already knew that, you just wanted to troll against anything not Microsoft again, as always.
 
 linux for me
 29 April, 2009 06:43
 
 Reply Vote
 - so an MS mistake nearly 10 years ago
 
 somehow makes Mozilla's screw up acceptable?
 
 P.S. CodeRed was IIS specific.
 
 JoeMama_z
 30 April, 2009 15:52
 
 Reply Vote
 - Lot of comments to your post
 
 Lot of comments to your post shifted focus from Mozilla to Microsoft. Yes, Microsoft software sucks - Vista blunder was a clear example. But, not taking sides, you are right - Mozilla QA blew it and the quality deterioration is quite visible over a year or so.
 
 andre@...
 29 April, 2009 07:04
 
 Reply Vote
- RE: Fixed ! Open Source in Action......
 
 IBM and Novell to name a few pay most of the open source programmers.
 
 Col Mustard
 29 April, 2009 13:39
 
 Reply Vote
include the version #

so good of you to include the version that was a problem. I thought info like that would be automatically provided by people at zdnet or wired. you guys are almost useless these days with your sensationalistic journalism. it is no wonder magazines and newspapers are falling by the wayside. fluff pieces are all the rage these days. Ed Burnette is a professional developer and author - coulda fooled me . . .

nospam@...
28 April, 2009 21:34

Reply Vote
- 3.0.10 is with the fix I think.
  
  I'm only saying that based on Ubuntu giving me the update from 3.0.9 to 3.0.10 just now.
  
  fr0thy2
  29 April, 2009 01:46
  
  Reply Vote
- it was in the article...
  
  Go read it again. The author includes a timeline in which the version number (3.0.9) is clearly stated.
  
  barence773
  29 April, 2009 03:58
  
  Reply Vote
  - Ubuntu didn't give me the update right away
    
    I had to do a manual update to get it. The cool thing is that I was able to update both of my computers without leaving my chair, thanks to the command line and ssh. I suppose it could be done with Windows, but I have no idea how...
    
    nt
    
    barence773
    29 April, 2009 04:01
    
    Reply Vote