Executive Summary

Summary
Title ActiveX controls built with Microsoft ATL fail to properly handle initialization data
Informations
Name VU#456745 First vendor Publication 2009-07-28
Vendor VU-CERT Last vendor Modification 2010-02-24
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#456745

ActiveX controls built with Microsoft ATL fail to properly handle initialization data

Overview

ActiveX controls that are built using a Microsoft ATL template may fail to properly handle initialization data, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

I. Description

Microsoft Active Template Library (ATL) is a set of C++ classes that are designed to simplify the creation of COM objects and ActiveX controls. An ActiveX control can be designated as "safe for scripting," which means that it can be used by an untrusted caller such as JavaScript in a web page, and/or it may be designated as "safe for initialization," which means that it can accept untrusted initialization data. ActiveX controls that are developed using the Microsoft ATL technology may fail to properly handle initialization data. The specific vulnerabilities include the use of uninitialized objects, unsafe usage of OleLoadFromStream, and the failure to check for a terminating NULL character. This may result in memory corruption that can be leveraged to execute code, or it may bypass Internet Explorer kill bit restrictions on unsafe controls.

II. Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code.

III. Solution

Apply an update

This vulnerability has been addressed in the update for Internet Explorer provided in Microsoft Security Bulletin MS09-034. This update helps prevent ActiveX controls that were built with the vulnerable ATL versions from being initialized with unsafe data patterns in Internet Explorer. This also includes techniques that can be used to bypass the kill bit in Internet Explorer.

Update and recompile ActiveX controls

Developers who have created ActiveX controls using Microsoft ATL should install the update for Microsoft Security Bulletin MS09-035 and recompile the ActiveX controls. This will cause the controls to use an updated ATL version that addresses these vulnerabilities.

Disable ActiveX

Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this and other ActiveX vulnerabilities. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document.

Systems Affected

VendorStatusDate NotifiedDate Updated
AdobeVulnerable2009-07-30
Alcatel-LucentUnknown2009-07-282009-07-28
America Online, Inc.Unknown2009-07-282009-07-28
Apple Inc.Not Vulnerable2009-07-282009-07-31
AttachmateUnknown2009-07-282009-07-28
Aurigma Inc. Vulnerable2009-07-282009-07-29
AxisUnknown2009-07-282009-07-28
BTUnknown2009-07-282009-07-28
Business ObjectsUnknown2009-07-282009-07-28
Callisto CorporationUnknown2009-07-282009-07-28
Cisco Systems, Inc.Vulnerable2009-07-282009-07-29
Computer Associates eTrust Security ManagementUnknown2009-07-282009-07-28
Computer Emergency Response Team BrazilUnknown2009-07-282009-07-28
Corel CorporationUnknown2009-07-282009-07-28
E-Book Systems Inc.Unknown2009-07-282009-07-28
eBayUnknown2009-07-282009-07-28
Electronic ArtsUnknown2009-07-282009-07-28
ESET, LLC.Unknown2009-07-282009-07-28
F5 Networks, Inc.Vulnerable2009-07-282009-07-29
GameTap-Turner Broadcasting subsidiaryUnknown2009-07-282009-07-28
GOVCERT-NLUnknown2009-07-282009-07-28
GracenoteUnknown2009-07-282009-07-28
Hewlett-Packard CompanyUnknown2009-07-282009-07-28
HusdawgUnknown2009-07-282009-07-28
IBM CorporationNot Vulnerable2009-07-282009-07-29
Iconics, Inc.Unknown2009-07-282009-07-28
IncrediMail Ltd.Unknown2009-07-282009-07-28
Infotriever, Inc.Unknown2009-07-282009-07-28
InterActual Technologies, Inc. Unknown2009-07-282009-07-28
Intuit, Inc.Unknown2009-07-282009-07-28
Juniper Networks, Inc.Unknown2009-07-282009-07-28
Kodak Easy Share GalleryUnknown2009-07-282009-07-28
LenovoUnknown2009-07-282009-07-28
LizardTech, IncUnknown2009-07-282009-07-28
LogicNPNot Vulnerable2009-07-282009-07-30
Lotus SoftwareUnknown2009-07-282009-07-28
Media Technology GroupUnknown2009-07-282009-07-28
Microsoft CorporationVulnerable2009-07-28
MotiveUnknown2009-07-282009-07-28
Move Networks, Inc.Unknown2009-07-282009-07-28
Namzak Labs Inc.Unknown2009-07-282009-07-28
NokiaUnknown2009-07-282009-07-28
Novell, Inc.Unknown2009-07-282009-07-28
Oracle CorporationUnknown2009-07-282009-07-28
OSISoftVulnerable2009-08-04
Panda Software Ltd.Unknown2009-07-282009-07-28
PNI Digital MediaUnknown2009-07-282009-07-28
Radiant SystemsUnknown2009-07-282009-07-28
RealNetworks, Inc.Unknown2009-07-282009-07-28
Research in Motion (RIM)Unknown2009-07-282009-07-28
SafeNetUnknown2009-07-282009-07-28
SAPUnknown2009-07-282009-07-28
ScriptLogicUnknown2009-07-282009-07-28
SiemensUnknown2009-07-282009-07-28
Simba TechnologiesUnknown2009-07-282009-07-28
SoftArtisans, IncVulnerable2009-07-282010-02-24
SonicWallVulnerable2009-07-282009-10-28
Sun Microsystems, Inc.Vulnerable2009-08-05
SupportSoft, Inc.Unknown2009-07-282009-07-28
SwiftViewUnknown2009-07-282009-07-28
SymantecUnknown2009-07-282009-07-28
Trend MicroUnknown2009-07-282009-07-28
Unigraphics SolutionsUnknown2009-07-282009-07-28
VanDyke SoftwareNot Vulnerable2009-07-282009-08-04
View22Unknown2009-07-282009-07-28
WeOnlyDo! SoftwareUnknown2009-07-282009-07-28
WinZip Computing, Inc.Unknown2009-07-282009-07-28
WorldspanUnknown2009-07-282009-07-28
XeroxUnknown2009-07-282009-07-28
Yahoo, Inc.Unknown2009-07-282009-07-28

References

http://www.kb.cert.org/vuls/id/180513
http://www.microsoft.com/technet/security/bulletin/ms09-034.mspx
http://www.microsoft.com/technet/security/bulletin/ms09-035.mspx
http://www.microsoft.com/security/atl.aspx
http://blogs.technet.com/msrc/archive/2009/07/28/microsoft-security-advisory-973882-microsoft-security-bulletins-ms09-034-and-ms09-035-released.aspx
http://blogs.msdn.com/sdl/archive/2009/07/28/atl-ms09-035-and-the-sdl.aspx
http://blogs.technet.com/ecostrat/archive/2009/07/27/threat-complexity-requires-new-levels-of-collaboration.aspx
http://www.microsoft.com/technet/security/advisory/973882.mspx
http://msdn.microsoft.com/en-us/library/ms680103(VS.85).aspx
http://msdn.microsoft.com/en-us/library/aa751977(VS.85).aspx
http://msdn.microsoft.com/en-us/library/t9adwcde(VS.80).aspx
http://support.microsoft.com/kb/168371
http://support.microsoft.com/kb/240797
http://blogs.adobe.com/psirt/2009/07/impact_of_microsoft_atl_vulner.html
http://www.adobe.com/support/security/advisories/apsa09-04.html
http://www.adobe.com/support/security/bulletins/apsb09-10.html
http://www.adobe.com/support/security/bulletins/apsb09-11.html
http://addxorrol.blogspot.com/2009/07/poking-around-msvidctldll.html
http://blogs.technet.com/srd/archive/2009/07/28/msvidctl-ms09-032-and-the-atl-vulnerability.aspx
http://blogs.technet.com/srd/archive/2009/07/28/atl-vulnerability-developer-deep-dive.aspx
http://blogs.technet.com/srd/archive/2009/07/28/internet-explorer-mitigations-for-atl-data-stream-vulnerabilities.aspx
http://blogs.technet.com/srd/archive/2009/07/28/overview-of-the-out-of-band-release.aspx
http://blogs.technet.com/bluehat/archive/2009/07/27/black-hat-usa-atl-killbit-bypass.aspx
http://support.softartisans.com/kbview.aspx?ID=1331

Credit

Thanks to Microsoft for reporting this vulnerability, who in turn credit David Dewey of IBM ISS X-Force and Ryan Smith of Verisign iDefense labs.

This document was written by Will Dormann.

Other Information

Date Public:2009-07-09
Date First Published:2009-07-28
Date Last Updated:2010-02-24
CERT Advisory: 
CVE-ID(s):CVE-2009-0901; CVE-2009-2493; CVE-2009-2495
NVD-ID(s):CVE-2009-0901CVE-2009-2493CVE-2009-2495
US-CERT Technical Alerts:TA09-209A
Metric:47.08
Document Revision:44

Original Source

Url : http://www.kb.cert.org/vuls/id/456745

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-264 Permissions, Privileges, and Access Controls
33 % CWE-200 Information Exposure
33 % CWE-94 Failure to Control Generation of Code ('Code Injection')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:6245
 
Oval ID: oval:org.mitre.oval:def:6245
Title: ATL COM Initialization Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2493
 Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Outlook Express
Windows Media Player
Windows ATL Component
DHTML Editing Component ActiveX Control
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6289
 
Oval ID: oval:org.mitre.oval:def:6289
Title: ATL Uninitialized Object Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-0901
 Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Outlook Express
Windows Media Player
Windows ATL Component
DHTML Editing Component ActiveX Control
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6304
 
Oval ID: oval:org.mitre.oval:def:6304
Title: ATL COM Initialization Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2493
 Version: 13
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual C++ 2005 Redistributable Package
Microsoft Visual C++ 2008 Redistributable Package
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6305
 
Oval ID: oval:org.mitre.oval:def:6305
Title: ATL Null String Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2495
 Version: 15
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual C++ 2005 Redistributable Package
Microsoft Visual C++ 2008 Redistributable Package
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6311
 
Oval ID: oval:org.mitre.oval:def:6311
Title: ATL Uninitialized Object Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-0901
 Version: 13
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual C++ 2005 Redistributable Package
Microsoft Visual C++ 2008 Redistributable Package
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6373
 
Oval ID: oval:org.mitre.oval:def:6373
Title: ATL Uninitialized Object Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-0901
 Version: 2
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
 Product(s): Microsoft Outlook 2002
Microsoft Outlook 2003
Microsoft Outlook 2007
Microsoft Visio Viewer 2002
Microsoft Office Visio Viewer 2003
Microsoft Office Visio Viewer 2007
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6421
 
Oval ID: oval:org.mitre.oval:def:6421
Title: ATL COM Initialization Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2493
 Version: 3
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6473
 
Oval ID: oval:org.mitre.oval:def:6473
Title: ATL COM Initialization Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2493
 Version: 2
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
 Product(s): Microsoft Outlook 2002
Microsoft Outlook 2003
Microsoft Outlook 2007
Microsoft Visio Viewer 2002
Microsoft Office Visio Viewer 2003
Microsoft Office Visio Viewer 2007
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6478
 
Oval ID: oval:org.mitre.oval:def:6478
Title: ATL Null String Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2495
 Version: 3
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
 Product(s): Microsoft Outlook 2002
Microsoft Outlook 2003
Microsoft Outlook 2007
Microsoft Visio Viewer 2002
Microsoft Office Visio Viewer 2003
Microsoft Office Visio Viewer 2007
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6621
 
Oval ID: oval:org.mitre.oval:def:6621
Title: ATL COM Initialization Vulnerability (CVE-2009-2493)
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2493
 Version: 1
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
 Product(s): Microsoft Internet Explorer
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6716
 
Oval ID: oval:org.mitre.oval:def:6716
Title: ATL COM Initialization Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2493
 Version: 37
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
 Product(s): Microsoft Outlook 2002
Microsoft Outlook 2003
Microsoft Outlook 2007
Microsoft Visio Viewer 2002
Microsoft Office Visio Viewer 2003
Microsoft Office Visio Viewer 2007
Microsoft Internet Explorer 5
Microsoft Internet Explorer 6
Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual C++ 2005 Redistributable Package
Microsoft Visual C++ 2008 Redistributable Package
Microsoft Outlook Express 5.5
Microsoft Outlook Express 6.0
Windows Media Player 9
Windows Media Player 10
Windows Media Player 11
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7573
 
Oval ID: oval:org.mitre.oval:def:7573
Title: ATL Null String Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-2495
 Version: 24
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Outlook 2002
Microsoft Outlook 2003
Microsoft Outlook 2007
Microsoft Visio Viewer 2002
Microsoft Office Visio Viewer 2003
Microsoft Office Visio Viewer 2007
Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual C++ 2005 Redistributable Package
Microsoft Visual C++ 2008 Redistributable Package
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7581
 
Oval ID: oval:org.mitre.oval:def:7581
Title: ATL Uninitialized Object Vulnerability
Description: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-0901
 Version: 35
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft Outlook 2002
Microsoft Outlook 2003
Microsoft Outlook 2007
Microsoft Visio Viewer 2002
Microsoft Office Visio Viewer 2003
Microsoft Office Visio Viewer 2007
Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual C++ 2005 Redistributable Package
Microsoft Visual C++ 2008 Redistributable Package
Microsoft Outlook Express 5.5
Microsoft Outlook Express 6.0
Windows Media Player 9
Windows Media Player 10
Windows Media Player 11
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 6
Application 5
Application 1
Os 1
Os 1
Os 2
Os 3
Os 2

SAINT Exploits

Description Link
Visual Studio Active Template Library uninitialized object More info here

OpenVAS Exploits

Date Description
2010-03-16 Name : FreeBSD Ports: openoffice.org
File : nvt/freebsd_openoffice.org.nasl
2009-12-04 Name : MS Internet Explorer 'Style' Object Remote Code Execution Vulnerability
File : nvt/gb_ms_ie_style_object_remote_code_exec_vuln.nasl
2009-11-11 Name : SLES11: Security update for IBM Java 1.6.0
File : nvt/sles11_java-1_6_0-ibm1.nasl
2009-10-14 Name : Microsoft Windows ATL COM Initialization Code Execution Vulnerability (973525)
File : nvt/secpod_ms09-055.nasl
2009-10-14 Name : MS ATL ActiveX Controls for MS Office Could Allow Remote Code Execution (973965)
File : nvt/secpod_ms09-060.nasl
2009-08-14 Name : Vulnerabilities in Microsoft ATL Could Allow Remote Code Execution (973908)
File : nvt/secpod_ms09-037.nasl
2009-08-03 Name : Microsoft Visual Studio ATL Remote Code Execution Vulnerability (969706)
File : nvt/secpod_ms09-035.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
56699 Microsoft Visual Studio Active Template Library (ATL) String Manipulation Arb...
56698 Microsoft Visual Studio Active Template Library (ATL) Data Stream Object Inst...
56696 Microsoft Visual Studio Active Template Library (ATL) Headers VariantClear Co...

Information Assurance Vulnerability Management (IAVM)

Date Description
2009-10-15 IAVM : 2009-A-0097 - Multiple Vulnerabilities in Microsoft Active Template Library
Severity : Category II - VMSKEY : V0021756
2009-08-13 IAVM : 2009-A-0067 - Multiple Vulnerabilities in Microsoft Active Template Library
Severity : Category II - VMSKEY : V0019882
2009-07-30 IAVM : 2009-B-0033 - Multiple Vulnerabilities in Visual Studio Active Template Library
Severity : Category II - VMSKEY : V0019798

Snort® IPS/IDS

Date Description
2014-01-10 Microsoft Excel Add-in for SQL Analysis Services 4 ActiveX clsid unicode access
RuleID : 16166 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Office Excel Add-in for SQL Analysis Services 4 ActiveX clsid access
RuleID : 16165 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Excel Add-in for SQL Analysis Services 3 ActiveX clsid unicode access
RuleID : 16164 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Office Excel Add-in for SQL Analysis Services 3 ActiveX clsid access
RuleID : 16163 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Excel Add-in for SQL Analysis Services 2 ActiveX clsid unicode access
RuleID : 16162 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Office Excel Add-in for SQL Analysis Services 2 ActiveX clsid access
RuleID : 16161 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Excel Add-in for SQL Analysis Services 1 ActiveX clsid unicode access
RuleID : 16160 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Office Excel Add-in for SQL Analysis Services 1 ActiveX clsid access
RuleID : 16159 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Video 6 ActiveX function call unicode access
RuleID : 15905 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Video 6 ActiveX function call access
RuleID : 15904 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Video 6 ActiveX function call
RuleID : 15671 - Revision : 15 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Video 6 ActiveX clsid access
RuleID : 15670 - Revision : 18 - Type : BROWSER-PLUGINS
2014-01-10 Microsoft Video 32 ActiveX clsid unicode access
RuleID : 15639 - Revision : 10 - Type : WEB-ACTIVEX
2014-01-10 Microsoft Video 32 ActiveX clsid access
RuleID : 15638 - Revision : 18 - Type : BROWSER-PLUGINS

Nessus® Vulnerability Scanner

Date Description
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_flash-player-6386.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-6741.nasl - Type : ACT_GATHER_INFO
2010-03-01 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_c97d7a37223311df96dd001b2134ef46.nasl - Type : ACT_GATHER_INFO
2010-02-12 Name : The remote Windows host has a program affected by multiple buffer overflows.
File : openoffice_32.nasl - Type : ACT_GATHER_INFO
2010-01-08 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-6740.nasl - Type : ACT_GATHER_INFO
2009-12-27 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12564.nasl - Type : ACT_GATHER_INFO
2009-12-08 Name : Arbitrary code can be executed on the remote host through a web browser.
File : smb_nt_ms09-072.nasl - Type : ACT_GATHER_INFO
2009-11-05 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-ibm-091102.nasl - Type : ACT_GATHER_INFO
2009-10-14 Name : Arbitrary code can be executed on the remote host through Microsoft Office Ac...
File : smb_nt_ms09-060.nasl - Type : ACT_GATHER_INFO
2009-10-13 Name : The remote Windows host has multiple ActiveX controls that are affected by mu...
File : smb_nt_ms09-055.nasl - Type : ACT_GATHER_INFO
2009-10-06 Name : The remote openSUSE host is missing a security update.
File : suse_flash-player-6387.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_flash-player-090731.nasl - Type : ACT_GATHER_INFO
2009-08-11 Name : Arbitrary code can be executed on the remote host through Microsoft Active Te...
File : smb_nt_ms09-037.nasl - Type : ACT_GATHER_INFO
2009-08-05 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_flash-player-090731.nasl - Type : ACT_GATHER_INFO
2009-08-05 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_flash-player-090731.nasl - Type : ACT_GATHER_INFO
2009-07-30 Name : Arbitrary code can be executed on the remote host through Microsoft Active Te...
File : smb_nt_ms09-035.nasl - Type : ACT_GATHER_INFO
2009-07-30 Name : The remote Windows host contains a browser plugin that is affected by multipl...
File : flash_player_apsb09_10.nasl - Type : ACT_GATHER_INFO
2009-07-29 Name : The remote Windows host contains an Internet Explorer plugin which uses a vul...
File : shockwave_player_apsb09_11.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2015-05-08 13:28:03
  • Multiple Updates
2013-05-11 00:57:06
  • Multiple Updates