56699 : Microsoft Visual Studio Active Template Library (ATL) String Manipulation Arbitrary Memory Disclosure
Printer | http://osvdb.org/56699 | Email This | Edit Vulnerability

Views This Week Views All Time Added to OSVDB Last Modified Modified (since 2008) Percent Complete
7 412 over 2 years ago about 1 year ago 14 times 55%

This Entry needs help! It is only 55% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Timeline

Disclosure Date Vendor Solution Date
2009-07-28 2009-07-28

Keywords

CSCta71728

Description

<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-2495" target="_blank">CVE</a>)</em> : The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka &quot;ATL Null String Vulnerability.&quot;

Classification

Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Solution: Patch / RCS
Exploit: Exploit Private, Exploit Rumored
Disclosure: Vendor Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Unknown or Incomplete

References

Tools & Filters

40421 42116

Credit

CVSSv2 Score

CVSSv2 Base Score = 7.8
Source: nvd.nist.gov | Generated: 2009-07-30 | Disagree?

Access_vector_2 Access_complexity_2 Authentication_2 Confidentiality_impact_2 Integrity_impact_0 Availability_impact_0

Blogs

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

2009/08/12 00:00:00 | MS09-035: Description of the ATL for Smart Devices security update for Visual Studio 2005 Service Pack 1: August 11, 2009

from: DotNetSlackers Latest ASP.NET News

973673 ... MS09-035: Description of the ATL for Smart Devices security update for Visual Studio 2005 Service Pack 1: August 11, 2009This RSS feed provided by kbAlerz.com.Visit kbAlertz.com to subscribe. It's 100% free and you'll be able to recieve e-mail or RSS updates for the technologies you pick from the Microsoft Knowledge Base.... Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight.

2009/09/09 09:02:00 | Microsoft Security Bulletin Minor Revision – September 8, 2009

from: Microsoft Patch Watch

Issued: September 8, 2009 Summary The following bulletin has undergone a minor revision increment. Please see the appropriate bulletin for more details. * MS09-035 – Moderate Bulletin Information: * MS09-035 – Moderate – http://www.microsoft.com/technet/security/bulletin/ms09-035.mspx – Reason for Revision: V2.3 (September 8, 2009): Added a new entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update, to communicate that Microsoft Knowledge Base Article 969706 has been revised to change the known issue KB974223 to KB974479, in order to offer a non-security update to fix the issue.

2009/09/09 09:02:00 | Microsoft Security Bulletin Minor Revision - September 8, 2009

from: MSMVPS.COM

Issued: September 8, 2009 Summary The following bulletin has undergone a minor revision increment. Please see the appropriate bulletin for more details. * MS09-035 - Moderate Bulletin Information: * MS09-035 - Moderate - http://www.microsoft.com/technet/security/bulletin/ms09-035.mspx - Reason for Revision: V2.3 (September 8, 2009): Added a new entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update, to communicate that Microsoft Knowledge Base Article 969706 has been revised to change the known issue KB974223 to KB974479, in order to offer a non-security update to fix the issue.

2009/09/08 22:52:00 | [MS Security Bulletin] Minor Revision - Issued: September 8, 2009

from: Cliff Hobbs - FAQShop.com and Microsoft MVP ConfigMgr/ SMS

Summary The following bulletin has undergone a minor revision increment. Please see the appropriate bulletin for more details.   * MS09-035 - Moderate Bulletin Information: * MS09-035 - Moderate   - http://www.microsoft.com/technet/security/bulletin/ms09-035.mspx   - Reason for Revision: V2.3 (September 8, 2009): Added a new entry     to the section, Frequently Asked Questions (FAQ) Related to     This Security Update, to communicate that

2009/09/03 17:22:00 | Microsoft Security Bulletin Advance Notification for September 2009

from: Microsoft Patch Watch

Microsoft Security Bulletins to be issued: September 8, 2009 This is an advance notification of security bulletins that Microsoft is intending to release on September 8, 2009. Microsoft is planning to release 5 security bulletins rated as critical all affecting Windows. http://www.microsoft.com/technet/security/Bulletin/ms09-sep.mspx Follow this link:Microsoft Security Bulletin Advance Notification for September 2009Tags: advance-notification, article, Bulletins, Microsoft, post, rated-as-critical,

2009/08/31 09:03:01 | Windows Update Goes Blank

from: Microsoft Patch Watch

I have a problem with Microsoft Update. This has either occurred after installing IE8 or could be due to a little viral problem I had about the same time. Continue reading here:Windows Update Goes BlankTags: little-viral, Microsoft, occurred, the-update, update, window-appears, wordRelated postsWindows Small Business Server 2008 Update Rollup 3 (0)How do I get update referred to in MS09-035 (0)yellow shield still there (0)Wont update Auto or Manual (0)Windows XP Updates – 0×8007066f Error (0)

2009/08/20 08:40:00 | Microsoft Security Bulletin Minor Revisions – August 19, 2009

from: Microsoft Patch Watch

Issued: August 19, 2009 Summary The following bulletins have undergone a minor revision increment. Please see the appropriate bulletin for more details. Excerpt from:Microsoft Security Bulletin Minor Revisions – August 19, 2009Tags: Bulletins, Microsoft, rating, service-pack, Visio, vista, Visual Studio, WindowsRelated postsMS09-037 – Critical: Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution (973908) – Version:1.2 (0)Microsoft Security Bulletin Minor

2009/08/19 08:00:00 | MS09-035 – Moderate: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706) – Version:2.2

from: Microsoft Patch Watch

Severity Rating: Moderate – Revision Note: V2.2 (August 19, 2009): Added a link to Microsoft Knowledge Base Article 974653 to provide instructions for using product codes to verify the installation of the updates for Microsoft Visual Studio 2005 Service Pack 1 and Microsoft Visual Studio 2008 and Microsoft Visual Studio 2008 Service Pack 1.Summary: This security update addresses several privately reported vulnerabilities in the public versions of the Microsoft Active Template Library (ATL) included with Visual Studio.

2009/08/12 16:00:32 | US CERT National Cyber Alert System – Microsoft Security Updates

from: Infosecurity.US

US-CERT has issued – through the agency’s National Cyber Alert System – a Technical Cyber Security Alert enumerated as TA09-223A . Specifically targeting yesterday’s Microsoft Corporation (NasdaqGS: MSFT ) update activity and focused on the 19 separate patches and updates, this is a rather largish Patch Tuesday affair. The full US-CERT notification appears after the jump.

2009/08/12 03:57:00 | So what are YOU doing tonight?

from: THE OFFICIAL BLOG OF THE SBS "DIVA"

Microsoft August 2009 Black Tuesday Overview: http://isc.sans.org/diary.html?storyid=6937 The Microsoft Security Response Center (MSRC) : August 2009 Bulletin Release: http://blogs.technet.com/msrc/archive/2009/08/11/august-2009-bulletin-release.aspx Security Research & Defense : MS09-039: More information about the WINS security bulletin: http://blogs.technet.com/srd/archive/2009/08/11/ms09-039-more-information-about-the-wins-security-bulletin.aspx Security Research & Defense :

2009/08/12 03:57:00 | So what are YOU doing tonight?

from: Microsoft Patch Watch

Microsoft August 2009 Black Tuesday Overview: http://isc.sans.org/diary.html?storyid=6937 The Microsoft Security Response Center (MSRC) : August 2009 Bulletin Release: http://blogs.technet.com/msrc/archive/2009/08/11/august-2009-bulletin-release.aspx Security Research & Defense : MS09-039: More information about the WINS security bulletin: http://blogs.technet.com/srd/archive/2009/08/11/ms09-039-more-information-about-the-wins-security-bulletin.aspx Security Research & Defense : MS09-037: Why we

Comments

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2012 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use