Vulnerabilities > CVE-2009-2493 - Permissions, Privileges, and Access Controls vulnerability in Microsoft products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-264
critical
nessus
NVD
Published: 2009-07-29
Updated: 2018-10-12

Summary

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
7
OS
Microsoft
9

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Msbulletin

  • bulletin_idMS09-055
    bulletin_url
    date2009-10-13T00:00:00
    impactRemote Code Execution
    knowledgebase_id973525
    knowledgebase_url
    severityCritical
    titleCumulative Security Update of ActiveX Kill Bits
  • bulletin_idMS09-072
    bulletin_url
    date2009-12-08T00:00:00
    impactRemote Code Execution
    knowledgebase_id976325
    knowledgebase_url
    severityCritical
    titleCumulative Security Update for Internet Explorer
  • bulletin_idMS09-060
    bulletin_url
    date2009-10-13T00:00:00
    impactRemote Code Execution
    knowledgebase_id973965
    knowledgebase_url
    severityCritical
    titleVulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution
  • bulletin_idMS09-037
    bulletin_url
    date2009-08-11T00:00:00
    impactRemote Code Execution
    knowledgebase_id973908
    knowledgebase_url
    severityCritical
    titleVulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution
  • bulletin_idMS09-035
    bulletin_url
    date2009-07-28T00:00:00
    impactRemote Code Execution
    knowledgebase_id969706
    knowledgebase_url
    severityModerate
    titleVulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id41392
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41392
    titleSuSE 11 Security Update : flash-player (SAT Patch Number 1149)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from SuSE 11 update information. The text itself is
# copyright (C) Novell, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(41392);
  script_version("1.18");
  script_cvs_date("Date: 2019/10/25 13:36:35");

  script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");

  script_name(english:"SuSE 11 Security Update : flash-player (SAT Patch Number 1149)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 11 host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Specially crafted Flash (SWF) files can cause a buffer overflow in
flash-player. Attackers could potentially exploit that to execute
arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 /
CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 /
CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 /
CVE-2009-1870)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-0901.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1862.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1863.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1864.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1865.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1866.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1867.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1868.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1869.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1870.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2395.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply SAT patch number 1149.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(59, 89, 94, 119, 189, 200, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:flash-player");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);

pl = get_kb_item("Host/SuSE/patchlevel");
if (pl) audit(AUDIT_OS_NOT, "SuSE 11.0");


flag = 0;
if (rpm_check(release:"SLED11", sp:0, cpu:"i586", reference:"flash-player-10.0.32.18-0.1.1")) flag++;
if (rpm_check(release:"SLED11", sp:0, cpu:"x86_64", reference:"")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12564.NASL
    descriptionIBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues. It also contains a timezone update for the current Fiji change (timezone 1.6.9s). The update fixes the following security issues : - A vulnerability in the Java Runtime Environment with decoding DER encoded data might allow a remote client to cause the JRE to crash, resulting in a denial of service condition. (CVE-2009-3876, CVE-2009-3877) - A buffer overflow vulnerability in the Java Runtime Environment audio system might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3867) - A buffer overflow vulnerability in the Java Runtime Environment with parsing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3868) - An integer overflow vulnerability in the Java Runtime Environment with reading JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3872) - A buffer overflow vulnerability in the Java Runtime Environment with processing JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3873) - A security vulnerability in the Java Runtime Environment with verifying HMAC digests might allow authentication to be bypassed. This action can allow a user to forge a digital signature that would be accepted as valid. Applications that validate HMAC-based digital signatures might be vulnerable to this type of attack. (CVE-2009-3875) - A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3869) - A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3871) - An integer overflow vulnerability in the Java Runtime Environment with processing JPEG images might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3874) - The Java Runtime Environment includes the Java Web Start technology that uses the Java Web Start ActiveX control to launch Java Web Start in Internet Explorer. A security vulnerability in the Active Template Library (ATL) in various releases of Microsoft Visual Studio, which is used by the Java Web Start ActiveX control, might allow the Java Web Start ActiveX control to be leveraged to run arbitrary code. This might occur as the result of a user of the Java Runtime Environment viewing a specially crafted web page that exploits this vulnerability. (CVE-2009-2493) Please also refer to http://www.ibm.com/developerworks/java/jdk/alerts for more information about this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id43599
    published2009-12-27
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43599
    titleSuSE9 Security Update : IBM Java 1.5.0 (YOU Patch Number 12564)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(43599);
  script_version("1.15");
  script_cvs_date("Date: 2019/10/25 13:36:33");

  script_cve_id("CVE-2009-2493", "CVE-2009-3867", "CVE-2009-3868", "CVE-2009-3869", "CVE-2009-3871", "CVE-2009-3872", "CVE-2009-3873", "CVE-2009-3874", "CVE-2009-3875", "CVE-2009-3876", "CVE-2009-3877");

  script_name(english:"SuSE9 Security Update : IBM Java 1.5.0 (YOU Patch Number 12564)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 9 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"IBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs
and security issues. It also contains a timezone update for the
current Fiji change (timezone 1.6.9s).

The update fixes the following security issues : 

  - A vulnerability in the Java Runtime Environment with
    decoding DER encoded data might allow a remote client to
    cause the JRE to crash, resulting in a denial of service
    condition. (CVE-2009-3876, CVE-2009-3877)

  - A buffer overflow vulnerability in the Java Runtime
    Environment audio system might allow an untrusted applet
    or Java Web Start application to escalate privileges.
    For example, an untrusted applet might grant itself
    permissions to read and write local files, or run local
    applications that are accessible to the user running the
    untrusted applet. (CVE-2009-3867)

  - A buffer overflow vulnerability in the Java Runtime
    Environment with parsing image files might allow an
    untrusted applet or Java Web Start application to
    escalate privileges. For example, an untrusted applet
    might grant itself permissions to read and write local
    files, or run local applications that are accessible to
    the user running the untrusted applet. (CVE-2009-3868)

  - An integer overflow vulnerability in the Java Runtime
    Environment with reading JPEG files might allow an
    untrusted applet or Java Web Start application to
    escalate privileges. For example, an untrusted applet
    might grant itself permissions to read and write local
    files, or run local applications that are accessible to
    the user running the untrusted applet. (CVE-2009-3872)

  - A buffer overflow vulnerability in the Java Runtime
    Environment with processing JPEG files might allow an
    untrusted applet or Java Web Start application to
    escalate privileges. For example, an untrusted applet
    might grant itself permissions to read and write local
    files, or run local applications that are accessible to
    the user running the untrusted applet. (CVE-2009-3873)

  - A security vulnerability in the Java Runtime Environment
    with verifying HMAC digests might allow authentication
    to be bypassed. This action can allow a user to forge a
    digital signature that would be accepted as valid.
    Applications that validate HMAC-based digital signatures
    might be vulnerable to this type of attack.
    (CVE-2009-3875)

  - A buffer overflow vulnerability in the Java Runtime
    Environment with processing image files might allow an
    untrusted applet or Java Web Start application to
    escalate privileges. For example, an untrusted applet
    might grant itself permissions to read and write local
    files or run local applications that are accessible to
    the user running the untrusted applet. (CVE-2009-3869)

  - A buffer overflow vulnerability in the Java Runtime
    Environment with processing image files might allow an
    untrusted applet or Java Web Start application to
    escalate privileges. For example, an untrusted applet
    might grant itself permissions to read and write local
    files or run local applications that are accessible to
    the user running the untrusted applet. (CVE-2009-3871)

  - An integer overflow vulnerability in the Java Runtime
    Environment with processing JPEG images might allow an
    untrusted applet or Java Web Start application to
    escalate privileges. For example, an untrusted applet
    might grant itself permissions to read and write local
    files or run local applications that are accessible to
    the user running the untrusted applet. (CVE-2009-3874)

  - The Java Runtime Environment includes the Java Web Start
    technology that uses the Java Web Start ActiveX control
    to launch Java Web Start in Internet Explorer. A
    security vulnerability in the Active Template Library
    (ATL) in various releases of Microsoft Visual Studio,
    which is used by the Java Web Start ActiveX control,
    might allow the Java Web Start ActiveX control to be
    leveraged to run arbitrary code. This might occur as the
    result of a user of the Java Runtime Environment viewing
    a specially crafted web page that exploits this
    vulnerability. (CVE-2009-2493)

Please also refer to http://www.ibm.com/developerworks/java/jdk/alerts
for more information about this update."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3867.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3868.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3869.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3871.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3872.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3873.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3874.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3875.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3876.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-3877.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply YOU patch number 12564.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Sun Java JRE AWT setDiffICM Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(119, 189, 264, 310, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/12/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/12/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 9 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SUSE9", reference:"IBMJava5-JRE-1.5.0-0.76")) flag++;
if (rpm_check(release:"SUSE9", reference:"IBMJava5-SDK-1.5.0-0.76")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-037.NASL
    descriptionThe remote Windows host contains a version of the Microsoft Active Template Library (ATL), included as part of Visual Studio or Visual C++, that is affected by multiple vulnerabilities : - A remote code execution issue affects the Microsoft Video ActiveX Control due to the a flaw in the function
    last seen2020-06-01
    modified2020-06-02
    plugin id40556
    published2009-08-11
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40556
    titleMS09-037: Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution (973908)
    code
    #
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(40556);
  script_version("1.28");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2008-0015", "CVE-2008-0020", "CVE-2009-0901", "CVE-2009-2493", "CVE-2009-2494");
  script_bugtraq_id(35558, 35585, 35828, 35832, 35982);
  script_xref(name:"MSFT", value:"MS09-037");
  script_xref(name:"MSKB", value:"973354");
  script_xref(name:"MSKB", value:"973507");
  script_xref(name:"MSKB", value:"973540");
  script_xref(name:"MSKB", value:"973815");
  script_xref(name:"MSKB", value:"973869");
  script_xref(name:"IAVA", value:"2009-A-0067");
  script_xref(name:"CERT", value:"180513");
  script_xref(name:"CERT", value:"456745");
  script_xref(name:"EDB-ID", value:"9108");
  script_xref(name:"EDB-ID", value:"16615");

  script_name(english:"MS09-037: Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution (973908)");
  script_summary(english:"Checks version of various files");

  script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host through Microsoft
Active Template Library.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host contains a version of the Microsoft Active
Template Library (ATL), included as part of Visual Studio or Visual C++,
that is affected by multiple vulnerabilities :

  - A remote code execution issue affects the Microsoft
    Video ActiveX Control due to the a flaw in the function
    'CComVariant::ReadFromStream' used in the ATL header,
    which fails to properly restrict untrusted data read
    from a stream. (CVE-2008-0015)

  - A remote code execution issue exists in the Microsoft
    Active Template Library due to an error in the 'Load'
    method of the 'IPersistStreamInit' interface, which
    could allow calls to 'memcpy' with untrusted data.
    (CVE-2008-0020)

  - An issue in the ATL headers could allow an attacker to
    force VariantClear to be called on a VARIANT that has
    not been correctly initialized and, by supplying a
    corrupt stream, to execute arbitrary code.
    (CVE-2009-0901)

  - Unsafe usage of 'OleLoadFromStream' could allow
    instantiation of arbitrary objects which can bypass
    related security policy, such as kill bits within
    Internet Explorer. (CVE-2009-2493)

  - A bug in the ATL header could allow reading a variant
    from a stream and leaving the variant type read with
    an invalid variant, which could be leveraged by an
    attacker to execute arbitrary code remotely.
    (CVE-2009-2494)");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-037");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(94, 119, 264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-037';
kbs = make_list("973354", "973507", "973540", "973815", "973869");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);


get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'2', vista:'0,2') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

programfiles = hotfix_get_programfilesdir();
if (!programfiles) exit(1, "Can't determine location of Program Files.");

if (tolower(programfiles[0]) != tolower(rootfile[0]))
{
  share = hotfix_path2share(path:programfiles);
  if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
}

commonfiles = hotfix_get_officecommonfilesdir();
if (!commonfiles) exit(1, "Can't determine location of Common Files.");

vuln = 0;

# Media Player.
if (
  # Vista / Windows Server 2008
  hotfix_is_vulnerable(os:"6.0", sp:2,             file:"Wmp.dll", version:"11.0.6002.22172", min_version:"11.0.6002.20000", dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"6.0", sp:2,             file:"Wmp.dll", version:"11.0.6002.18065",                                dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"6.0", sp:1,             file:"Wmp.dll", version:"11.0.6001.7114",  min_version:"11.0.6001.7100",  dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"6.0", sp:1,             file:"Wmp.dll", version:"11.0.6001.7007",                                 dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"6.0", sp:0,             file:"Wmp.dll", version:"11.0.6000.6511",  min_version:"11.0.6000.6500",  dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"6.0", sp:0,             file:"Wmp.dll", version:"11.0.6000.6352",                                 dir:"\System32", bulletin:bulletin, kb:'973540') ||

  # Windows 2003
  hotfix_is_vulnerable(os:"5.2", sp:2,             file:"Wmp.dll", version:"10.0.0.4006",                                    dir:"\System32", bulletin:bulletin, kb:'973540') ||

  # Windows XP
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Wmp.dll", version:"9.0.0.4507",                                     dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x64", file:"Wmp.dll", version:"11.0.5721.5268",  min_version:"11.0.0.0",        dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x64", file:"Wmp.dll", version:"10.0.0.4006",                                    dir:"\System32", bulletin:bulletin, kb:'973540') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Wmp.dll", version:"9.0.0.3271",                                     dir:"\System32", bulletin:bulletin, kb:'973540') ||

  # Windows 2000
  hotfix_is_vulnerable(os:"5.0",                   file:"Wmp.dll", version:"9.0.0.3364",                                     dir:"\System32", bulletin:bulletin, kb:'973540')
) vuln++;


# ATL.
if (
  # Vista / Windows Server 2008
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Atl.dll", version:"3.5.2284.2",                               dir:"\System32", bulletin:bulletin, kb:'973507') ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Atl.dll", version:"3.5.2284.2",                               dir:"\System32", bulletin:bulletin, kb:'973507') ||
  hotfix_is_vulnerable(os:"6.0", sp:0, file:"Atl.dll", version:"3.5.2284.2",                               dir:"\System32", bulletin:bulletin, kb:'973507') ||

  # Windows 2003
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Atl.dll", version:"3.5.2284.2", dir:"\System32", bulletin:bulletin, kb:'973507') ||

  # Windows XP
  hotfix_is_vulnerable(os:"5.1", sp:3, file:"Atl.dll", version:"3.5.2284.2", dir:"\System32", bulletin:bulletin, kb:'973507') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, file:"Atl.dll", version:"3.5.2284.2", dir:"\System32", bulletin:bulletin, kb:'973507') ||

  # Windows 2000
  hotfix_is_vulnerable(os:"5.0",       file:"Atl.dll", version:"3.0.9793.0", dir:"\System32", bulletin:bulletin, kb:'973507')
) vuln++;


# MSWebDVD ActiveX Control.
if (
  # Vista / Windows Server 2008
  #
  # empty

  # Windows 2003
  hotfix_is_vulnerable(os:"5.2", sp:2, arch:"x86", file:"Mswebdvd.dll", version:"6.5.3790.4564", dir:"\System32", bulletin:bulletin, kb:'973815') ||

  # Windows XP
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mswebdvd.dll", version:"6.5.2600.5848", dir:"\System32", bulletin:bulletin, kb:'973815') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mswebdvd.dll", version:"6.5.2600.3603", dir:"\System32", bulletin:bulletin, kb:'973815')

  # Windows 2000
  #
  # empty
) vuln++;


# Outlook Express.
NetUseDel(close:FALSE);
if (
  # Vista / Windows Server 2008
  #
  # empty

  # Windows 2003
  hotfix_is_vulnerable(os:"5.2", sp:2,             file:"Msoe.dll", version:"6.0.3790.4548",                         dir:"\Outlook Express", path:programfiles, bulletin:bulletin, kb:'973354') ||

  # Windows XP
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Msoe.dll", version:"6.0.2900.5843",                         dir:"\Outlook Express", path:programfiles, bulletin:bulletin, kb:'973354') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x64", file:"Msoe.dll", version:"6.0.3790.4548",                         dir:"\Outlook Express", path:programfiles, bulletin:bulletin, kb:'973354') ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Msoe.dll", version:"6.0.2900.3598",                         dir:"\Outlook Express", path:programfiles, bulletin:bulletin, kb:'973354') ||

  # Windows 2000
  hotfix_is_vulnerable(os:"5.0",                   file:"Msoe.dll", version:"6.0.2800.1983",  min_version:"6.0.0.0", dir:"\Outlook Express", path:programfiles, bulletin:bulletin, kb:'973354') ||
  hotfix_is_vulnerable(os:"5.0",                   file:"Msoe.dll", version:"5.50.5003.1000",                        dir:"\Outlook Express", path:programfiles, bulletin:bulletin, kb:'973354')
) vuln++;


# DHTML Editing Component ActiveX control/
if  (!commonfiles)
{
  hotfix_check_fversion_end();
  exit(1, "Can't determine location of Common Files.");
}
if (typeof(commonfiles) != 'array')
{
  temp = commonfiles;
  commonfiles = make_array('commonfiles', commonfiles);
}
checkeddirs = make_array();
NetUseDel(close:FALSE);
foreach ver (keys(commonfiles))
{
  dir = commonfiles[ver];
  if (checkeddirs[dir]) continue;
  checkeddirs[dir] = 1;
  if (
    # Vista / Windows Server 2008
    #
    # empty

    # Windows 2003
    hotfix_is_vulnerable(os:"5.2", sp:2, file:"Dhtmled.ocx", version:"6.1.0.9247", dir:"\Microsoft Shared\Triedit", path:dir, bulletin:bulletin, kb:'973869') ||

    # Windows XP
    hotfix_is_vulnerable(os:"5.1", sp:3, file:"Dhtmled.ocx", version:"6.1.0.9247", dir:"\Microsoft Shared\Triedit", path:dir, bulletin:bulletin, kb:'973869') ||
    hotfix_is_vulnerable(os:"5.1", sp:2, file:"Dhtmled.ocx", version:"6.1.0.9247", dir:"\Microsoft Shared\Triedit", path:dir, bulletin:bulletin, kb:'973869') ||

    # Windows 2000
    hotfix_is_vulnerable(os:"5.0",       file:"Dhtmled.ocx", version:"6.1.0.9234", dir:"\Microsoft Shared\Triedit", path:dir, bulletin:bulletin, kb:'973869')
  ) vuln++;
}

if (vuln)
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-072.NASL
    descriptionThe remote host is missing IE Security Update 976325. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.
    last seen2020-06-01
    modified2020-06-02
    plugin id43064
    published2009-12-08
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43064
    titleMS09-072: Cumulative Security Update for Internet Explorer (976325)
    code
    #
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(43064);
  script_version("1.29");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2009-2493", "CVE-2009-3671", "CVE-2009-3672", "CVE-2009-3673", "CVE-2009-3674");
  script_bugtraq_id(35828, 37085, 37188, 37212, 37213);
  script_xref(name:"MSFT", value:"MS09-072");
  script_xref(name:"MSKB", value:"976325");
  script_xref(name:"CERT", value:"456745");
  script_xref(name:"CERT", value:"515749");
  script_xref(name:"EDB-ID", value:"16547");

  script_name(english:"MS09-072: Cumulative Security Update for Internet Explorer (976325)");
  script_summary(english:"Checks version of Mshtml.dll / MSrating.dll");

  script_set_attribute(
    attribute:"synopsis",
    value:
"Arbitrary code can be executed on the remote host through a web
browser."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The remote host is missing IE Security Update 976325.

The remote version of IE is affected by several vulnerabilities that may
allow an attacker to execute arbitrary code on the remote host."
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-072");
  script_set_attribute(
    attribute:"solution",
    value:
"Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, and Windows 7."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MS09-072 Microsoft Internet Explorer Style getElementsByTagName Memory Corruption');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_cwe_id(94, 264, 399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/12/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/12/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:ie");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-072';
kb = '976325';

kbs = make_list(kb);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);


get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'2', vista:'0,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Windows 7 and Windows Server 2008 R2
  #
  # - Internet Explorer 8
  hotfix_is_vulnerable(os:"6.1",       file:"Mshtml.dll", version:"8.0.7600.20579", min_version:"8.0.7600.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.1",       file:"Mshtml.dll", version:"8.0.7600.16466", min_version:"8.0.7600.16000", dir:"\system32", bulletin:bulletin, kb:kb) ||

  # Vista / Windows 2008
  #
  # - Internet Explorer 8
  hotfix_is_vulnerable(os:"6.0",       file:"Mshtml.dll", version:"8.0.6001.22956", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0",       file:"Mshtml.dll", version:"8.0.6001.18865", min_version:"8.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  # - Internet Explorer 7
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.22252", min_version:"7.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.18130", min_version:"7.0.6002.18000",  dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.22550", min_version:"7.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.18349", min_version:"7.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:0, file:"Mshtml.dll", version:"7.0.6000.21148", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:0, file:"Mshtml.dll", version:"7.0.6000.16945", min_version:"7.0.6000.16000", dir:"\system32", bulletin:bulletin, kb:kb) ||

  # Windows 2003 / XP x64
  #
  # - Internet Explorer 8
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.22945", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.18854", min_version:"8.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
  # - Internet Explorer 7
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.21148", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.16945", min_version:"7.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
   # - Internet Explorer 6
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"6.0.3790.4611",  min_version:"6.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||

  # Windows XP x86
  #
  # - Internet Explorer 8
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.22945", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.18854", min_version:"8.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.22945", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.18854", min_version:"8.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
  # - Internet Explorer 7
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.21148", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.16945", min_version:"7.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.21148", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.16945", min_version:"7.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
  # - Internet Explorer 6 SP1
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Msrating.dll", version:"6.0.2800.1996",  min_version:"6.0.0.0",      dir:"\system32", bulletin:bulletin, kb:kb) ||
  # - Internet Explorer 6
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"6.0.2900.5897",  min_version:"6.0.2900.0",     dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"6.0.2900.3640",  min_version:"6.0.2900.0",     dir:"\system32", bulletin:bulletin, kb:kb) ||

  # Windows 2000
  #
  # - Internet Explorer 6 w/ Service Pack 1
  hotfix_is_vulnerable(os:"5.0", file:"Msrating.dll", version:"6.0.2800.1996", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
  # - Internet Explorer 5.01 w/ Service Pack 4
  hotfix_is_vulnerable(os:"5.0", file:"Mshtml.dll",   version:"5.0.3882.2700",  min_version:"5.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb)
)
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}
  • NASL familyWindows
    NASL idSHOCKWAVE_PLAYER_APSB09_11.NASL
    descriptionThe remote Windows host contains a version of Adobe
    last seen2020-06-01
    modified2020-06-02
    plugin id40421
    published2009-07-29
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40421
    titleShockwave Player < 11.5.0.601 Multiple Vulnerabilities (APSB09-11)
    code
    #
# (C) Tenable Network Security, Inc.
#


include('compat.inc');


if (description)
{
  script_id(40421);
  script_version("1.17");
  script_cvs_date("Date: 2018/11/15 20:50:28");

  script_cve_id('CVE-2009-0901', 'CVE-2009-2495', 'CVE-2009-2493');
  script_bugtraq_id(35845);

  script_name(english:'Shockwave Player < 11.5.0.601 Multiple Vulnerabilities (APSB09-11)');
  script_summary(english:'Checks version of Shockwave Player');

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains an Internet Explorer plugin which
uses a vulnerable version of the Microsoft Active Template Library
(ATL).");
  script_set_attribute(attribute:"description", value:
"The remote Windows host contains a version of Adobe's Shockwave Player
that is earlier than 11.5.0.601. Such versions were compiled against a
version of Microsoft's Active Template Library (ATL) that contained a
vulnerability. If an attacker can trick a user of the affected
software into opening such a file, this issue could be leveraged to
execute arbitrary code with the privileges of that user.");
  script_set_attribute(attribute:"see_also", value:"http://blogs.adobe.com/psirt/2009/07/impact_of_microsoft_atl_vulner.html/");
  script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb09-11.html");
  script_set_attribute(attribute:"solution", value:
"Uninstall the Internet Explorer version of Shockwave Player version
11.5.0.600 and earlier, restart the system, and then install version
11.5.0.601 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(94, 200, 264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:shockwave_player");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:'Windows');

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies('smb_hotfixes.nasl');
  script_require_keys('SMB/Registry/Enumerated');
  script_require_ports(139, 445);

  exit(0);
}

include('global_settings.inc');
include('smb_func.inc');
include("audit.inc");


# Connect to the appropriate share.
if (!get_kb_item('SMB/Registry/Enumerated')) exit(0, 'SMB/Registry/Enumerated KB item is missing.');
name    =  kb_smb_name();
port    =  kb_smb_transport();

login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();



if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
rc = NetUseAdd(login:login, password:pass, domain:domain, share:'IPC$');
if (rc != 1)
{
  NetUseDel();
  exit(1, 'Can not connect to IPC$ share.');
}

# Connect to remote registry.
hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if (isnull(hklm))
{
  NetUseDel();
  exit(1, 'Can not connect to remote registry.');
}

# Check whether it's installed.
variants = make_array();

# - check for the ActiveX control.
clsids = make_list(
  '{4DB2E429-B905-479A-9EFF-F7CBD9FD52DE}',
  '{233C1507-6A77-46A4-9443-F871F945D258}',
  '{166B1BCA-3F9C-11CF-8075-444553540000}'     # used in versions <= 10.x.
);
foreach clsid (clsids)
{
  key = 'SOFTWARE\\Classes\\CLSID\\' + clsid + '\\InprocServer32';
  key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
  if (!isnull(key_h))
  {
    item = RegQueryValue(handle:key_h, item:NULL);
    if (!isnull(item))
    {
      file = item[1];
      variants[file] = 'ActiveX';
    }
    RegCloseKey(handle:key_h);
  }
}

RegCloseKey(handle:hklm);
if (max_index(keys(variants)) == 0)
{
  NetUseDel();
  exit(0, 'Shockwave Player for Internet Explorer is not installed.');
}

# Determine the version of each instance found.
files = make_array();
info = '';

foreach file (keys(variants))
{
  # Don't report again if the name differs only in its case.
  if (files[tolower(file)]++) continue;

  variant = variants[file];

  share = ereg_replace(pattern:'^([A-Za-z]):.*', replace:'\\1$', string:file);
  file2 =  ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:'\\1', string:file);
  NetUseDel(close:FALSE);

  rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
  if (rc != 1)
  {
    NetUseDel();
    exit(1, 'Can not connect to '+share+' share.');
  }

  fh = CreateFile(
    file:file2,
    desired_access:GENERIC_READ,
    file_attributes:FILE_ATTRIBUTE_NORMAL,
    share_mode:FILE_SHARE_READ,
      create_disposition:OPEN_EXISTING
  );
  if (!isnull(fh))
  {
    ver = GetFileVersion(handle:fh);
    CloseFile(handle:fh);

    if (
      isnull(ver) ||
      (ver[0] == 0 && ver[1] == 0 && ver[2] == 0 && ver[3] == 0)
    )
    {
      NetUseDel();
      exit(1, "Failed to get the file version from '"+file+"'.");
    }

    if (
      ver[0] < 11 ||
      (
        ver[0] == 11 &&
        (
          ver[1] < 5 ||
          (ver[1] == 5 && ver[2] == 0 && ver[3] < 601)
        )
      )
    )
    {
      version = string(ver[0], '.', ver[1], '.', ver[2], '.', ver[3]);

      if (variant == 'ActiveX')
      {
        info += '  - ActiveX control (for Internet Explorer) :\n';
      }

      info += '    ' + file + ', ' + version + '\n';
    }
  }
  NetUseDel(close:FALSE);
}
NetUseDel();


if (!info) exit(0, 'No vulnerable installs of Shockwave Player were found.');

if (report_verbosity > 0)
{
  # nb: each vulnerable instance adds 2 lines to 'info'.
  if (max_index(split(info)) > 2)
    shck = 's';
  else shck = '';

  report = string(
    '\n',
    'Nessus has identified the following vulnerable instance', shck, ' of Shockwave\n',
    'Player for Internet Explorer installed on the remote host :\n',
    '\n',
    info
  );
  security_hole(port:get_kb_item('SMB/transport'), extra:report);
}
else security_hole(get_kb_item('SMB/transport'));
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-055.NASL
    descriptionMicrosoft ActiveX controls that were compiled using the vulnerable Active Template Library described in Microsoft Security Bulletin MS09-035 have remote code execution vulnerabilities. A remote attacker could exploit them to execute arbitrary code by tricking a user into requesting a maliciously crafted web page.
    last seen2020-06-01
    modified2020-06-02
    plugin id42111
    published2009-10-13
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42111
    titleMS09-055: Cumulative Security Update of ActiveX Kill Bits (973525)
    code
    #
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(42111);
  script_version("1.33");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2009-2493");
  script_bugtraq_id(35828);
  script_xref(name:"MSFT", value:"MS09-055");
  script_xref(name:"MSKB", value:"973525");
  script_xref(name:"CERT", value:"456745");

  script_name(english:"MS09-055: Cumulative Security Update of ActiveX Kill Bits (973525)");
  script_summary(english:"Checks if several kill bits have been set");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has multiple ActiveX controls that are affected
by multiple code execution vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"Microsoft ActiveX controls that were compiled using the vulnerable
Active Template Library described in Microsoft Security Bulletin
MS09-035 have remote code execution vulnerabilities.  A remote attacker
could exploit them to execute arbitrary code by tricking a user into
requesting a maliciously crafted web page.");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-055");
  script_set_attribute( attribute:"solution", value:
"Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_activex_func.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-055';
kb = '973525';

kbs = make_list(kb);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);


get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'2', vista:'0,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);

if (activex_init() != ACX_OK) exit(1, "activex_init() failed.");


# Test each control.
info = "";
clsids = make_list(
  "{0002E531-0000-0000-C000-000000000046}",  # msowc.dll
  "{4C85388F-1500-11D1-A0DF-00C04FC9E20F}",  # msowc.dll
  "{0002E532-0000-0000-C000-000000000046}",  # msowc.dll
  "{0002E554-0000-0000-C000-000000000046}",  # owc10.dll
  "{0002E55C-0000-0000-C000-000000000046}",  # owc11.dll
  "{279D6C9A-652E-4833-BEFC-312CA8887857}",  # viewer.dll
  "{B1F78FEF-3DB7-4C56-AF2B-5DCCC7C42331}",  # msmail.dll
  "{C832BE8F-4B89-4579-A217-DB92E7A27915}",  # msmail.dll
  "{A9A7297E-969C-43F1-A1EF-51EBEA36F850}",  # mailcomm.dll
  "{DD8C2179-1B4A-4951-B432-5DE3D1507142}",  # msmail.dll
  "{4F1E5B1A-2A80-42ca-8532-2D05CB959537}",  # MsnPUpld.dll
  "{27A3D328-D206-4106-8D33-1AA39B13394B}",  # ReportBuilderAddin.dll
  "{DB640C86-731C-484A-AAAF-750656C9187D}",  # ReportBuilderAddin.dll
  "{15721a53-8448-4731-8bfc-ed11e128e444}",  # ReportBuilderAddin.dll
  "{3267123E-530D-4E73-9DA7-79F01D86A89F}"   # ReportBuilderAddin.dll
);

foreach clsid (clsids)
{
  # Make sure the control is installed
  file = activex_get_filename(clsid:clsid);
  if (isnull(file) || !file) continue;

  if (activex_get_killbit(clsid:clsid) == 0)
  {
    info += '  ' + clsid + '\n';
    if (!thorough_tests) break;
  }
}
activex_end();


if (info)
{
  if (report_verbosity > 0)
  {
    if (max_index(split(info)) > 1) s = "s";
    else s = "";

    report = string(
      "\n",
      "The kill bit has not been set for the following control", s, " :\n",
      "\n",
      info
    );

    if (!thorough_tests)
    {
      report = string(
        report,
        "\n",
        "Note that Nessus did not check whether there were other kill bits\n",
        "that have not been set because the 'Perofrm thorough tests' setting\n",
        "was not enabled when this scan was run.\n"
      );
    }
    hotfix_add_report(report, bulletin:bulletin, kb:kb);
    security_warning(port:kb_smb_transport(), extra:report);
  }
  else
  {
   hotfix_add_report(bulletin:bulletin, kb:kb);
   hotfix_security_warning();
  }

  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
}
else audit(AUDIT_HOST_NOT, 'affected');
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6386.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id51731
    published2011-01-27
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51731
    titleSuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(51731);
  script_version ("1.13");
  script_cvs_date("Date: 2019/10/25 13:36:36");

  script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");

  script_name(english:"SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Specially crafted Flash (SWF) files can cause a buffer overflow in
flash-player. Attackers could potentially exploit that to execute
arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 /
CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 /
CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 /
CVE-2009-1870)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-0901.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1862.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1863.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1864.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1865.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1866.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1867.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1868.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1869.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-1870.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2395.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6386.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(59, 89, 94, 119, 189, 200, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLED10", sp:2, reference:"flash-player-9.0.246.0-0.3")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");
  • NASL familySuSE Local Security Checks
    NASL idSUSE_JAVA-1_5_0-IBM-6741.NASL
    descriptionIBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues. The timezone update to 1.6.9s (with the latest Fiji change). - A vulnerability in the Java Runtime Environment with decoding DER encoded data might allow a remote client to cause the JRE to crash, resulting in a denial of service condition. (CVE-2009-3876 / CVE-2009-3877) - A buffer overflow vulnerability in the Java Runtime Environment audio system might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3867) - A buffer overflow vulnerability in the Java Runtime Environment with parsing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3868) - An integer overflow vulnerability in the Java Runtime Environment with reading JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3872) - A buffer overflow vulnerability in the Java Runtime Environment with processing JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3873) - A security vulnerability in the Java Runtime Environment with verifying HMAC digests might allow authentication to be bypassed. This action can allow a user to forge a digital signature that would be accepted as valid. Applications that validate HMAC-based digital signatures might be vulnerable to this type of attack. (CVE-2009-3875) - A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3869) - A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3871) - An integer overflow vulnerability in the Java Runtime Environment with processing JPEG images might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3874) - The Java Runtime Environment includes the Java Web Start technology that uses the Java Web Start ActiveX control to launch Java Web Start in Internet Explorer. A security vulnerability in the Active Template Library (ATL) in various releases of Microsoft Visual Studio, which is used by the Java Web Start ActiveX control, might allow the Java Web Start ActiveX control to be leveraged to run arbitrary code. This might occur as the result of a user of the Java Runtime Environment viewing a specially crafted web page that exploits this vulnerability. (CVE-2009-2493) Please also see http://www.ibm.com/developerworks/java/jdk/alerts/
    last seen2020-06-01
    modified2020-06-02
    plugin id49863
    published2010-10-11
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49863
    titleSuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 6741)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_JAVA-1_5_0-IBM-6740.NASL
    descriptionIBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues. The timezone update to 1.6.9s (with the latest Fiji change). - A vulnerability in the Java Runtime Environment with decoding DER encoded data might allow a remote client to cause the JRE to crash, resulting in a denial of service condition. (CVE-2009-3876 / CVE-2009-3877) - A buffer overflow vulnerability in the Java Runtime Environment audio system might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3867) - A buffer overflow vulnerability in the Java Runtime Environment with parsing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3868) - An integer overflow vulnerability in the Java Runtime Environment with reading JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3872) - A buffer overflow vulnerability in the Java Runtime Environment with processing JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3873) - A security vulnerability in the Java Runtime Environment with verifying HMAC digests might allow authentication to be bypassed. This action can allow a user to forge a digital signature that would be accepted as valid. Applications that validate HMAC-based digital signatures might be vulnerable to this type of attack. (CVE-2009-3875) - A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3869) - A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3871) - An integer overflow vulnerability in the Java Runtime Environment with processing JPEG images might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-3874) - The Java Runtime Environment includes the Java Web Start technology that uses the Java Web Start ActiveX control to launch Java Web Start in Internet Explorer. A security vulnerability in the Active Template Library (ATL) in various releases of Microsoft Visual Studio, which is used by the Java Web Start ActiveX control, might allow the Java Web Start ActiveX control to be leveraged to run arbitrary code. This might occur as the result of a user of the Java Runtime Environment viewing a specially crafted web page that exploits this vulnerability. (CVE-2009-2493) Please also see http://www.ibm.com/developerworks/java/jdk/alerts/
    last seen2020-06-01
    modified2020-06-02
    plugin id43822
    published2010-01-08
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43822
    titleSuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 6740)
  • NASL familyWindows
    NASL idOPENOFFICE_32.NASL
    descriptionThe version of Sun Microsystems OpenOffice.org installed on the remote host is prior to version 3.2. It is, therefore, affected by several issues : - Signatures may not be handled properly due to a vulnerability in the libxml2 library. (CVE-2006-4339) - There is an HMAC truncation authentication bypass vulnerability in the libxmlsec library. (CVE-2009-0217) - The application is bundled with a vulnerable version of the Microsoft VC++ runtime. (CVE-2009-2493) - Specially crafted XPM files are not processed properly, which could lead to arbitrary code execution. (CVE-2009-2949) - Specially crafted GIF files are not processed properly, which could lead to arbitrary code execution. (CVE-2009-2950) - Specially crafted Microsoft Word documents are not processed properly, which could lead to arbitrary code execution. (CVE-2009-3301 / CVE-2009-3302)
    last seen2020-06-01
    modified2020-06-02
    plugin id44597
    published2010-02-12
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44597
    titleSun OpenOffice.org < 3.2 Multiple Vulnerabilities
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-035.NASL
    descriptionThe remote Windows host contains a version of the Microsoft Active Template Library (ATL), included as part of Visual Studio or Visual C++, that is affected by multiple vulnerabilities : - On systems with components and controls installed that were built using Visual Studio ATL, an issue in the ATL headers could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized and, by supplying a corrupt stream, to execute arbitrary code. (CVE-2009-0901) - On systems with components and controls installed that were built using Visual Studio ATL, unsafe usage of OleLoadFromStream could allow instantiation of arbitrary objects that can bypass related security policy, such as kill bits within Internet Explorer. (CVE-2009-2493) - On systems with components and controls installed that were built using Visual Studio ATL, an issue in the ATL headers could allow a string to be read without a terminating NULL character, which could lead to disclosure of information in memory. (CVE-2009-2495)
    last seen2020-06-01
    modified2020-06-02
    plugin id40435
    published2009-07-30
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40435
    titleMS09-035: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB09_10.NASL
    descriptionThe remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly affected by multiple vulnerabilities : - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862) - A vulnerability in the Microsoft Active Template Library (ATL) which could allow an attacker who successfully exploits the vulnerability to take control of the affected system. (CVE-2009-0901, CVE-2009-2395, CVE-2009-2493) - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863) - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864) - A NULL pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865) - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866) - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867 - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868) - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869) - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id40434
    published2009-07-30
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40434
    titleFlash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id40488
    published2009-08-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40488
    titleopenSUSE Security Update : flash-player (flash-player-1148)
  • NASL familyWindows
    NASL idWIN_SERVER_2008_NTLM_PCI.NASL
    descriptionAccording to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id108811
    published2018-04-03
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108811
    titleWindows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id40489
    published2009-08-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40489
    titleopenSUSE Security Update : flash-player (flash-player-1148)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_JAVA-1_6_0-IBM-091102.NASL
    descriptionThe IBM Java 6 JRE/SDK was updated to Service Release 6, fixing various bugs and security issues. The following security issues were fixed : - A security vulnerability in the JNLPAppletLauncher might impact users of the Sun JDK and JRE. Non-current versions of the JNLPAppletLauncher might be re-purposed with an untrusted Java applet to write arbitrary files on the system of the user downloading and running the untrusted applet. (CVE-2009-2676) The JNLPAppletLauncher is a general purpose JNLP-based applet launcher class for deploying applets that use extension libraries containing native code. - The Java Runtime Environment includes the Java Web Start technology that uses the Java Web Start ActiveX control to launch Java Web Start in Internet Explorer. A security vulnerability in the Active Template Library (ATL) in various releases of Microsoft Visual Studio, which is used by the Java Web Start ActiveX control, might allow the Java Web Start ActiveX control to be leveraged to run arbitrary code. This might occur as the result of a user of the Java Runtime Environment viewing a specially crafted web page that exploits this vulnerability. (CVE-2009-2493) - A vulnerability in the Java Runtime Environment audio system might allow an untrusted applet or Java Web Start application to access system properties. (CVE-2009-2670) - A vulnerability with verifying HMAC-based XML digital signatures in the XML Digital Signature implementation included with the Java Runtime Environment (JRE) might allow authentication to be bypassed. Applications that validate HMAC-based XML digital signatures might be vulnerable to this type of attack. (CVE-2009-0217) Note: This vulnerability cannot be exploited by an untrusted applet or Java Web Start application. - A vulnerability in the Java Runtime Environment with the SOCKS proxy implementation might allow an untrusted applet or Java Web Start application to determine the username of the user running the applet or application. (CVE-2009-2671 / CVE-2009-2672) A second vulnerability in the Java Runtime Environment with the proxy mechanism implementation might allow an untrusted applet or Java Web Start application to obtain browser cookies and leverage those cookies to hijack sessions. - A vulnerability in the Java Runtime Environment with the proxy mechanism implementation might allow an untrusted applet or Java Web Start application to make non-authorized socket or URL connections to hosts other than the origin host. (CVE-2009-2673) - An integer overflow vulnerability in the Java Runtime Environment with processing JPEG images might allow an untrusted Java Web Start application to escalate privileges. For example, an untrusted application might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-2674) - An integer overflow vulnerability in the Java Runtime Environment with unpacking applets and Java Web Start applications using the unpack200 JAR unpacking utility might allow an untrusted applet or application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. (CVE-2009-2675) - A vulnerability in the Java Runtime Environment (JRE) with parsing XML data might allow a remote client to create a denial-of-service condition on the system that the JRE runs on. (CVE-2009-2625)
    last seen2020-06-01
    modified2020-06-02
    plugin id42396
    published2009-11-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42396
    titleSuSE 11 Security Update : IBM Java 1.6.0 (SAT Patch Number 1497)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6387.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id42001
    published2009-10-06
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42001
    titleopenSUSE 10 Security Update : flash-player (flash-player-6387)
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-060.NASL
    descriptionOne or more ActiveX controls included in Microsoft Outlook or Visio and installed on the remote Windows host was compiled with a version of Microsoft Active Template Library (ATL) that is affected by potentially several vulnerabilities : - An issue in the ATL headers could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized and, by supplying a corrupt stream, to execute arbitrary code. (CVE-2009-0901) - Unsafe usage of
    last seen2020-06-01
    modified2020-06-02
    plugin id42116
    published2009-10-14
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42116
    titleMS09-060: Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_C97D7A37223311DF96DD001B2134EF46.NASL
    descriptionOpenOffice.org Security Team reports : Fixed in OpenOffice.org 3.2 CVE-2006-4339: Potential vulnerability from 3rd party libxml2 libraries CVE-2009-0217: Potential vulnerability from 3rd party libxmlsec libraries CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable version of MSVC Runtime CVE-2009-2949: Potential vulnerability related to XPM file processing CVE-2009-2950: Potential vulnerability related to GIF file processing CVE-2009-3301/2: Potential vulnerability related to MS-Word document processing
    last seen2020-06-01
    modified2020-06-02
    plugin id44922
    published2010-03-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44922
    titleFreeBSD : openoffice.org -- multiple vulnerabilities (c97d7a37-2233-11df-96dd-001b2134ef46)

Oval

  • accepted2009-09-28T04:00:17.323-04:00
    classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameJ. Daniel Brown
      organizationDTCC
    • nameRachana Shetty
      organizationSecPod Technologies
    • nameJosh Turpin
      organizationSymantec Corporation
    • nameChandan S
      organizationSecPod Technologies
    • nameDragos Prisaca
      organizationG2, Inc.
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Outlook Express 5.5 SP2 is installed.
      ovaloval:org.mitre.oval:def:504
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Outlook Express 6 SP1 is installed.
      ovaloval:org.mitre.oval:def:488
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Windows Server 2003 (ia64) SP2 is installed
      ovaloval:org.mitre.oval:def:1442
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentWindows Media Player v9 is installed.
      ovaloval:org.mitre.oval:def:2147
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentWindows Media Player v9 is installed.
      ovaloval:org.mitre.oval:def:2147
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentWindows Media Player v9 is installed.
      ovaloval:org.mitre.oval:def:2147
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentWindows Media Player v10 is installed.
      ovaloval:org.mitre.oval:def:2172
    • commentWindows Media Player v10 is installed.
      ovaloval:org.mitre.oval:def:2172
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentWindows Media Player v10 is installed.
      ovaloval:org.mitre.oval:def:2172
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentWindows Media Player v10 is installed.
      ovaloval:org.mitre.oval:def:2172
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentWindows Media Player v11 is installed.
      ovaloval:org.mitre.oval:def:2126
    • commentWindows Media Player v11 is installed.
      ovaloval:org.mitre.oval:def:2126
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Vista (32-bit) Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:4873
    • commentMicrosoft Windows Vista x64 Edition Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:5254
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentMicrosoft Windows Server 2008 (ia-64) is installed
      ovaloval:org.mitre.oval:def:5667
    • commentMicrosoft Windows Vista (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6124
    • commentMicrosoft Windows Vista x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5594
    • commentMicrosoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5653
    • commentMicrosoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6216
    • commentMicrosoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6150
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Vista (32-bit) Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:4873
    • commentMicrosoft Windows Vista x64 Edition Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:5254
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentMicrosoft Windows Server 2008 (ia-64) is installed
      ovaloval:org.mitre.oval:def:5667
    • commentMicrosoft Windows Vista (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6124
    • commentMicrosoft Windows Vista x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5594
    • commentMicrosoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5653
    • commentMicrosoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6216
    • commentMicrosoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6150
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentMicrosoft Windows Server 2003 (ia64) SP2 is installed
      ovaloval:org.mitre.oval:def:1442
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Vista (32-bit) Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:4873
    • commentMicrosoft Windows Vista x64 Edition Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:5254
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentMicrosoft Windows Server 2008 (ia-64) is installed
      ovaloval:org.mitre.oval:def:5667
    • commentMicrosoft Windows Vista (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6124
    • commentMicrosoft Windows Vista x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5594
    • commentMicrosoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5653
    • commentMicrosoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6216
    • commentMicrosoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6150
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentMicrosoft Windows Server 2003 (ia64) SP2 is installed
      ovaloval:org.mitre.oval:def:1442
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows Server 2003 (ia64) SP2 is installed
      ovaloval:org.mitre.oval:def:1442
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6245
    statusdeprecated
    submitted2009-08-11T13:00:00
    titleATL COM Initialization Vulnerability
    version78
  • accepted2009-09-14T04:00:09.792-04:00
    classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameJ. Daniel Brown
      organizationDTCC
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationG2, Inc.
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentMicrosoft Visual Studio .NET 2003 SP1 is installed
      ovaloval:org.mitre.oval:def:168
    • commentMicrosoft Visual Studio 2005 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6401
    • commentMicrosoft Visual Studio 2008 is installed
      ovaloval:org.mitre.oval:def:5401
    • commentMicrosoft Visual Studio 2008 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6205
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6304
    statusdeprecated
    submitted2009-07-28T13:00:00
    titleATL COM Initialization Vulnerability
    version79
  • accepted2009-11-30T04:00:41.161-05:00
    classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameJ. Daniel Brown
      organizationDTCC
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentMicrosoft Windows Server 2003 (ia64) SP2 is installed
      ovaloval:org.mitre.oval:def:1442
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Vista (32-bit) Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:4873
    • commentMicrosoft Windows Vista x64 Edition Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:5254
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentMicrosoft Windows Server 2008 (ia-64) is installed
      ovaloval:org.mitre.oval:def:5667
    • commentMicrosoft Windows Vista (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6124
    • commentMicrosoft Windows Vista x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5594
    • commentMicrosoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:5653
    • commentMicrosoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6216
    • commentMicrosoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed
      ovaloval:org.mitre.oval:def:6150
    • commentMicrosoft Windows 7 (32-bit) is installed
      ovaloval:org.mitre.oval:def:6165
    • commentMicrosoft Windows 7 x64 Edition is installed
      ovaloval:org.mitre.oval:def:5950
    • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
      ovaloval:org.mitre.oval:def:6438
    • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
      ovaloval:org.mitre.oval:def:5954
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6421
    statusdeprecated
    submitted2009-10-13T13:00:00
    titleATL COM Initialization Vulnerability
    version24
  • accepted2009-11-30T04:00:46.551-05:00
    classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameJ. Daniel Brown
      organizationDTCC
    • nameShane Shaffer
      organizationG2, Inc.
    definition_extensions
    • commentMicrosoft Outlook 2002 is installed
      ovaloval:org.mitre.oval:def:5179
    • commentMicrosoft Outlook 2003 is installed
      ovaloval:org.mitre.oval:def:5505
    • commentMicrosoft Outlook 2007 is installed
      ovaloval:org.mitre.oval:def:5352
    • commentMicrosoft Visio Viewer 2002 is installed
      ovaloval:org.mitre.oval:def:6500
    • commentMicrosoft Office Visio Viewer 2003 is installed
      ovaloval:org.mitre.oval:def:6420
    • commentMicrosoft Office Visio Viewer 2007 is installed
      ovaloval:org.mitre.oval:def:6128
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6473
    statusdeprecated
    submitted2009-10-13T13:00:00
    titleATL COM Initialization Vulnerability
    version6
  • classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameJ. Daniel Brown
      organizationDTCC
    definition_extensions
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Internet Explorer 5.01 SP4 is installed
      ovaloval:org.mitre.oval:def:325
    • commentMicrosoft Windows 2000 SP4 or later is installed
      ovaloval:org.mitre.oval:def:229
    • commentMicrosoft Internet Explorer 6 is installed
      ovaloval:org.mitre.oval:def:563
    • commentMicrosoft Windows XP (x86) SP2 is installed
      ovaloval:org.mitre.oval:def:754
    • commentMicrosoft Internet Explorer 6 is installed
      ovaloval:org.mitre.oval:def:563
    • commentMicrosoft Windows XP (x86) SP3 is installed
      ovaloval:org.mitre.oval:def:5631
    • commentMicrosoft Internet Explorer 6 is installed
      ovaloval:org.mitre.oval:def:563
    • commentMicrosoft Windows XP x64 Edition SP2 is installed
      ovaloval:org.mitre.oval:def:4193
    • commentMicrosoft Windows Server 2003 SP2 (x86) is installed
      ovaloval:org.mitre.oval:def:1935
    • commentMicrosoft Windows Server 2003 SP2 (x64) is installed
      ovaloval:org.mitre.oval:def:2161
    • commentMicrosoft Windows Server 2003 (ia64) SP2 is installed
      ovaloval:org.mitre.oval:def:1442
    • commentMicrosoft Internet Explorer 6 is installed
      ovaloval:org.mitre.oval:def:563
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6621
    statusdeprecated
    submitted2009-12-08T13:00:00
    titleATL COM Initialization Vulnerability (CVE-2009-2493)
    version69
  • accepted2015-08-10T04:01:07.487-04:00
    classvulnerability
    contributors
    • nameJ. Daniel Brown
      organizationDTCC
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameRachana Shetty
      organizationSecPod Technologies
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameShane Shaffer
      organizationG2, Inc.
    • nameJosh Turpin
      organizationSymantec Corporation
    • nameChandan S
      organizationSecPod Technologies
    • nameDragos Prisaca
      organizationG2, Inc.
    • nameDragos Prisaca
      organizationG2, Inc.
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Internet Explorer 5.01 SP4 is installed
      ovaloval:org.mitre.oval:def:325
    • commentMicrosoft Internet Explorer 6 is installed
      ovaloval:org.mitre.oval:def:563
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
      ovaloval:org.mitre.oval:def:396
    • commentMicrosoft Outlook 2002 is installed
      ovaloval:org.mitre.oval:def:5179
    • commentMicrosoft Outlook 2003 is installed
      ovaloval:org.mitre.oval:def:5505
    • commentMicrosoft Outlook 2007 SP1 is installed
      ovaloval:org.mitre.oval:def:18961
    • commentMicrosoft Outlook 2007 SP2 is installed
      ovaloval:org.mitre.oval:def:18844
    • commentMicrosoft Visio Viewer 2002 is installed
      ovaloval:org.mitre.oval:def:6500
    • commentMicrosoft Office Visio Viewer 2003 is installed
      ovaloval:org.mitre.oval:def:6420
    • commentMicrosoft Office Visio Viewer 2007 is installed
      ovaloval:org.mitre.oval:def:6128
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
      ovaloval:org.mitre.oval:def:396
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentMicrosoft Windows Server 2008 (ia-64) is installed
      ovaloval:org.mitre.oval:def:5667
    • commentMicrosoft Windows 7 (32-bit) is installed
      ovaloval:org.mitre.oval:def:6165
    • commentMicrosoft Windows 7 x64 Edition is installed
      ovaloval:org.mitre.oval:def:5950
    • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
      ovaloval:org.mitre.oval:def:6438
    • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
      ovaloval:org.mitre.oval:def:5954
    • commentMicrosoft Visual Studio .NET 2003 SP1 is installed
      ovaloval:org.mitre.oval:def:168
    • commentMicrosoft Visual Studio 2005 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6401
    • commentMicrosoft Visual Studio 2008 is installed
      ovaloval:org.mitre.oval:def:5401
    • commentMicrosoft Visual Studio 2008 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6205
    • commentMicrosoft Visual C++ 2005 Redistributable Package is installed
      ovaloval:org.mitre.oval:def:29007
    • commentMicrosoft Visual C++ 2008 Redistributable Package is installed
      ovaloval:org.mitre.oval:def:28587
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Outlook Express 5.5 SP2 is installed.
      ovaloval:org.mitre.oval:def:504
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Outlook Express 6 SP1 is installed.
      ovaloval:org.mitre.oval:def:488
    • commentMicrosoft Outlook Express 6.0 for Windows XP/2003 is installed
      ovaloval:org.mitre.oval:def:208
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
      ovaloval:org.mitre.oval:def:396
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentWindows Media Player v9 is installed.
      ovaloval:org.mitre.oval:def:2147
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentWindows Media Player v9 is installed.
      ovaloval:org.mitre.oval:def:2147
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentWindows Media Player v9 is installed.
      ovaloval:org.mitre.oval:def:2147
    • commentWindows Media Player v10 is installed.
      ovaloval:org.mitre.oval:def:2172
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentWindows Media Player v11 is installed.
      ovaloval:org.mitre.oval:def:2126
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentWindows Media Player v11 is installed.
      ovaloval:org.mitre.oval:def:2126
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentWindows Media Player v11 is installed.
      ovaloval:org.mitre.oval:def:2126
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentWindows Media Player v11 is installed.
      ovaloval:org.mitre.oval:def:2126
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
      ovaloval:org.mitre.oval:def:396
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Server 2008 (32-bit) is installed
      ovaloval:org.mitre.oval:def:4870
    • commentMicrosoft Windows Server 2008 (64-bit) is installed
      ovaloval:org.mitre.oval:def:5356
    • commentMicrosoft Windows Server 2008 (ia-64) is installed
      ovaloval:org.mitre.oval:def:5667
    • commentMicrosoft Windows 2000 is installed
      ovaloval:org.mitre.oval:def:85
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
      ovaloval:org.mitre.oval:def:396
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows XP (32-bit) is installed
      ovaloval:org.mitre.oval:def:1353
    • commentMicrosoft Windows Server 2003 (32-bit) is installed
      ovaloval:org.mitre.oval:def:1870
    • commentMicrosoft Windows Server 2003 (x64) is installed
      ovaloval:org.mitre.oval:def:730
    • commentMicrosoft Windows XP x64 is installed
      ovaloval:org.mitre.oval:def:15247
    • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
      ovaloval:org.mitre.oval:def:396
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    • commentMicrosoft Windows Vista (32-bit) is installed
      ovaloval:org.mitre.oval:def:1282
    • commentMicrosoft Windows Vista x64 Edition is installed
      ovaloval:org.mitre.oval:def:2041
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6716
    statusaccepted
    submitted2009-12-26T17:00:00.000-05:00
    titleATL COM Initialization Vulnerability
    version111

Seebug

bulletinFamilyexploit
descriptionBugraq ID: 35828 CVE ID：CVE-2009-2493 Microsoft Visual Studio是一款微软公司的开发工具套件系列产品。 Microsoft活动模版库(ATL)处理数据流对象实例化时ATL头存在错误，远程攻击者可以利用漏洞绕过IE等Kill-bits安全策略，并导致任意代码执行。 此漏洞只影响安装了使用Visual Studio ATL的组件和控件的系统。如果组件或控件使用ATL，不安全使用OleLoadFromStream允许任意对象实例化，可绕过相关的安全策略，如 Internet Explorer的Kill bits位。远程攻击者可以构建恶意WEB页，诱使用户打开来执行任意代码。 Microsoft Visual Studio 2008 SP1 Microsoft Visual Studio 2008 0 Microsoft Visual Studio 2005 Team Edition for Testers 0 Microsoft Visual Studio 2005 Team Edition for Developers 0 Microsoft Visual Studio 2005 Team Edition for Architects 0 Microsoft Visual Studio 2005 Team Edition 0 Microsoft Visual Studio 2005 Standard Edition 0 Microsoft Visual Studio 2005 Professional Edition 0 Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools SP1 Microsoft Visual Studio 2005 SP1 Microsoft Visual Studio .NET 2003 + Microsoft Visual Basic .NET Standard 2003 + Microsoft Visual C# .NET Standard 2003 + Microsoft Visual C++ .NET Standard 2003 + Microsoft Visual J# .NET Standard 2003 Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual C++ 2008 Redistributable Package SP1 Microsoft Visual C++ 2008 Redistributable Package 0 Microsoft Visual C++ 2008 SP1 Microsoft Visual C++ 2008 0 Microsoft Visual C++ 2005 Redistributable Package SP1 Microsoft Visual C++ 2005 Redistributable Package SP1 Microsoft Visual C++ 2005 Redistributable Package 0 Microsoft Visual C++ 2005 SP1 用户可参考如下安全补丁： Microsoft Visual C++ 2005 SP1 Microsoft Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=766a6af7-ec73 -40ff-b072-9112bab119c2 Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual Studio .NET 2003 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?FamilyID=63ce454e-f69c -44e3-89fb-eb23c2e2154e Microsoft Visual Studio 2005 SP1 Microsoft Visual Studio 2005 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?FamilyID=7c8729dc-06a2 -4538-a90d-ff9464dc0197 Microsoft Visual C++ 2008 SP1 Microsoft Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=2051a0c1-c9b5 -4b0a-a8f5-770a549fd78c Microsoft Visual Studio 2008 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=294de390-3c94 -49fb-a014-9a38580e64cb Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools SP1 Microsoft Visual Studio 64-bit Hosted Visual C++ Tools 2005 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?FamilyID=43f96f2a-69c6 -4c5e-b72c-0edfa35f4fc2 Microsoft Visual C++ 2008 0 Microsoft Microsoft Visual C++ 2008 Redistributable Package ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=8b29655e-9da4 -4b6b-9ac5-687ca0770f93 Microsoft Visual Studio 2008 ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=8f9da646-94dd -469d-baea-a4306270462c
idSSV:11914
last seen2017-11-19
modified2009-07-29
published2009-07-29
reporterRoot
titleMicrosoft Visual Studio ATL COM对象远程代码执行漏洞

References