I am a long-time Firefox user and remember that usually the UAC prompt popped up when Firefox updated itself. Some months ago (or is it years?), Firefox obviously changed the way it updates itself: I didn't see the UAC prompt since then in such situations. The updates were performed as expected, though. So far, so good.
Several weeks ago, I decided to lock down my systems further. One of the most important steps involved was to remove the user account I normally work with from the Administrators group. That had less impact than I had expected (and hence was the right step which I would recommend to everyone), but it led to an interesting problem with Firefox:
Firefox offers updates for itself as usual via popup at the right top of its window. When I click "Update" in that popup (the blue button), it pretends to do something, and even the new page where the improvements are listed or further features are advertised opens as usual.
However, the "update" runs surprisingly fast, and I am not asked to restart Firefox afterwards. Consequently, Firefox is not being updated during the process. I am considering this a sensational security breach, and it does throw a bad light onto Firefox development and quality management.
Steps to reproduce:
- Install a three-month old version of Firefox as administrator
- Use Firefox in a user account which is not in the
Administratorsgroup - Wait until Firefox offers an update
- Accept the offer, i.e. click on the blue button "Update"
- Observe that Firefox pretends to update itself and even opens a new page in a new tab which advertises Firefox's advantages or the new features (this is the point where a normal user believes to have installed the newest version and to be safe)
- Restart Firefox and observe that it did not perform the update, e.g. via
Help -> About Firefox(which shows that it is still the old version which is installed)
I am asking myself whether I should trust Firefox any more given that they are not even able to implement the most important, yet most simple, security mechanism correctly, i.e. the update mechanism. Even worse, it doesn't fail with an appropriate error message, but pretends to have done the update, where in fact it didn't, misleading non-expert users and putting them seriously at risk.
Did I misunderstand something? What am I missing?
Update #1
In the comments, Moshe Katz has pointed out that the Mozilla Maintenance Service must run to enable updates as a non-administrator. I knew that this service had been installed (I remembered it from the installation where it asked for it), but checked again and was surprised that it was installed, but it was not running, and its startup type was set to Manual.
I made myself administrator, changed the startup type to Automatic and tried to start the service. This led to a dialog box with the following error message:
Windows could not start the Mozilla Maintenance Service service on Local Computer.
Error 1: Incorrect function
Obviously, my Firefox installation somehow got screwed, and I can't start the Maintenance Service. I'll now try to reinstall only the maintenance service; if this is not possible, I'll reinstall Firefox.
