The Active Template Library (ATL) in Microsoft Visual Studio .NET...
Vulnerability Description
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-0901
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.adobe.com/support/security/bulletins/apsb09-11.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
- http://www.securityfocus.com/bid/35832
- http://www.vupen.com/english/advisories/2009/2034
- http://www.us-cert.gov/cas/techalerts/TA09-223A.html
- http://www.adobe.com/support/security/bulletins/apsb09-13.html
- http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1
- http://www.us-cert.gov/cas/techalerts/TA09-286A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035
- http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7581
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6289
- http://marc.info/?l=bugtraq&m=126592505426855&w=2
- http://marc.info/?l=bugtraq&m=126592505426855&w=2
- http://secunia.com/advisories/36187
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6311
- http://www.vupen.com/english/advisories/2009/2232
- http://www.adobe.com/support/security/bulletins/apsb09-10.html
- http://secunia.com/advisories/36374
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
- http://www.adobe.com/support/security/advisories/apsa09-04.html
- http://secunia.com/advisories/36746
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6373
- http://secunia.com/advisories/35967
- http://www.us-cert.gov/cas/techalerts/TA09-195A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060
More from microsoft
View All →Affected Vendor
microsoft
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.