Vulnerabilities > CVE-2009-2495 - Information Exposure vulnerability in Microsoft Visual C++, Visual Studio and Visual Studio .Net

047910
CVSS 7.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
NONE
Availability impact
NONE
network
low complexity
microsoft
CWE-200
nessus

Summary

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Msbulletin

  • bulletin_idMS09-060
    bulletin_url
    date2009-10-13T00:00:00
    impactRemote Code Execution
    knowledgebase_id973965
    knowledgebase_url
    severityCritical
    titleVulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution
  • bulletin_idMS09-035
    bulletin_url
    date2009-07-28T00:00:00
    impactRemote Code Execution
    knowledgebase_id969706
    knowledgebase_url
    severityModerate
    titleVulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution

Nessus

  • NASL familyWindows
    NASL idSHOCKWAVE_PLAYER_APSB09_11.NASL
    descriptionThe remote Windows host contains a version of Adobe
    last seen2020-06-01
    modified2020-06-02
    plugin id40421
    published2009-07-29
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40421
    titleShockwave Player < 11.5.0.601 Multiple Vulnerabilities (APSB09-11)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include('compat.inc');
    
    
    if (description)
    {
      script_id(40421);
      script_version("1.17");
      script_cvs_date("Date: 2018/11/15 20:50:28");
    
      script_cve_id('CVE-2009-0901', 'CVE-2009-2495', 'CVE-2009-2493');
      script_bugtraq_id(35845);
    
      script_name(english:'Shockwave Player < 11.5.0.601 Multiple Vulnerabilities (APSB09-11)');
      script_summary(english:'Checks version of Shockwave Player');
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains an Internet Explorer plugin which
    uses a vulnerable version of the Microsoft Active Template Library
    (ATL).");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host contains a version of Adobe's Shockwave Player
    that is earlier than 11.5.0.601. Such versions were compiled against a
    version of Microsoft's Active Template Library (ATL) that contained a
    vulnerability. If an attacker can trick a user of the affected
    software into opening such a file, this issue could be leveraged to
    execute arbitrary code with the privileges of that user.");
      script_set_attribute(attribute:"see_also", value:"http://blogs.adobe.com/psirt/2009/07/impact_of_microsoft_atl_vulner.html/");
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb09-11.html");
      script_set_attribute(attribute:"solution", value:
    "Uninstall the Internet Explorer version of Shockwave Player version
    11.5.0.600 and earlier, restart the system, and then install version
    11.5.0.601 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(94, 200, 264);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:shockwave_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:'Windows');
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies('smb_hotfixes.nasl');
      script_require_keys('SMB/Registry/Enumerated');
      script_require_ports(139, 445);
    
      exit(0);
    }
    
    include('global_settings.inc');
    include('smb_func.inc');
    include("audit.inc");
    
    
    # Connect to the appropriate share.
    if (!get_kb_item('SMB/Registry/Enumerated')) exit(0, 'SMB/Registry/Enumerated KB item is missing.');
    name    =  kb_smb_name();
    port    =  kb_smb_transport();
    
    login   =  kb_smb_login();
    pass    =  kb_smb_password();
    domain  =  kb_smb_domain();
    
    
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:'IPC$');
    if (rc != 1)
    {
      NetUseDel();
      exit(1, 'Can not connect to IPC$ share.');
    }
    
    # Connect to remote registry.
    hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
    if (isnull(hklm))
    {
      NetUseDel();
      exit(1, 'Can not connect to remote registry.');
    }
    
    # Check whether it's installed.
    variants = make_array();
    
    # - check for the ActiveX control.
    clsids = make_list(
      '{4DB2E429-B905-479A-9EFF-F7CBD9FD52DE}',
      '{233C1507-6A77-46A4-9443-F871F945D258}',
      '{166B1BCA-3F9C-11CF-8075-444553540000}'     # used in versions <= 10.x.
    );
    foreach clsid (clsids)
    {
      key = 'SOFTWARE\\Classes\\CLSID\\' + clsid + '\\InprocServer32';
      key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
      if (!isnull(key_h))
      {
        item = RegQueryValue(handle:key_h, item:NULL);
        if (!isnull(item))
        {
          file = item[1];
          variants[file] = 'ActiveX';
        }
        RegCloseKey(handle:key_h);
      }
    }
    
    RegCloseKey(handle:hklm);
    if (max_index(keys(variants)) == 0)
    {
      NetUseDel();
      exit(0, 'Shockwave Player for Internet Explorer is not installed.');
    }
    
    # Determine the version of each instance found.
    files = make_array();
    info = '';
    
    foreach file (keys(variants))
    {
      # Don't report again if the name differs only in its case.
      if (files[tolower(file)]++) continue;
    
      variant = variants[file];
    
      share = ereg_replace(pattern:'^([A-Za-z]):.*', replace:'\\1$', string:file);
      file2 =  ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:'\\1', string:file);
      NetUseDel(close:FALSE);
    
      rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
      if (rc != 1)
      {
        NetUseDel();
        exit(1, 'Can not connect to '+share+' share.');
      }
    
      fh = CreateFile(
        file:file2,
        desired_access:GENERIC_READ,
        file_attributes:FILE_ATTRIBUTE_NORMAL,
        share_mode:FILE_SHARE_READ,
          create_disposition:OPEN_EXISTING
      );
      if (!isnull(fh))
      {
        ver = GetFileVersion(handle:fh);
        CloseFile(handle:fh);
    
        if (
          isnull(ver) ||
          (ver[0] == 0 && ver[1] == 0 && ver[2] == 0 && ver[3] == 0)
        )
        {
          NetUseDel();
          exit(1, "Failed to get the file version from '"+file+"'.");
        }
    
        if (
          ver[0] < 11 ||
          (
            ver[0] == 11 &&
            (
              ver[1] < 5 ||
              (ver[1] == 5 && ver[2] == 0 && ver[3] < 601)
            )
          )
        )
        {
          version = string(ver[0], '.', ver[1], '.', ver[2], '.', ver[3]);
    
          if (variant == 'ActiveX')
          {
            info += '  - ActiveX control (for Internet Explorer) :\n';
          }
    
          info += '    ' + file + ', ' + version + '\n';
        }
      }
      NetUseDel(close:FALSE);
    }
    NetUseDel();
    
    
    if (!info) exit(0, 'No vulnerable installs of Shockwave Player were found.');
    
    if (report_verbosity > 0)
    {
      # nb: each vulnerable instance adds 2 lines to 'info'.
      if (max_index(split(info)) > 2)
        shck = 's';
      else shck = '';
    
      report = string(
        '\n',
        'Nessus has identified the following vulnerable instance', shck, ' of Shockwave\n',
        'Player for Internet Explorer installed on the remote host :\n',
        '\n',
        info
      );
      security_hole(port:get_kb_item('SMB/transport'), extra:report);
    }
    else security_hole(get_kb_item('SMB/transport'));
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-035.NASL
    descriptionThe remote Windows host contains a version of the Microsoft Active Template Library (ATL), included as part of Visual Studio or Visual C++, that is affected by multiple vulnerabilities : - On systems with components and controls installed that were built using Visual Studio ATL, an issue in the ATL headers could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized and, by supplying a corrupt stream, to execute arbitrary code. (CVE-2009-0901) - On systems with components and controls installed that were built using Visual Studio ATL, unsafe usage of OleLoadFromStream could allow instantiation of arbitrary objects that can bypass related security policy, such as kill bits within Internet Explorer. (CVE-2009-2493) - On systems with components and controls installed that were built using Visual Studio ATL, an issue in the ATL headers could allow a string to be read without a terminating NULL character, which could lead to disclosure of information in memory. (CVE-2009-2495)
    last seen2020-06-01
    modified2020-06-02
    plugin id40435
    published2009-07-30
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40435
    titleMS09-035: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40435);
      script_version("1.32");
      script_cvs_date("Date: 2018/11/15 20:50:30");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-2493", "CVE-2009-2495");
      script_bugtraq_id(35828, 35830, 35832);
      script_xref(name:"MSFT", value:"MS09-035");
      script_xref(name:"MSKB", value:"973544");
      script_xref(name:"MSKB", value:"973551");
      script_xref(name:"MSKB", value:"973552");
      script_xref(name:"MSKB", value:"973675");
      script_xref(name:"IAVB", value:"2009-B-0033");
      script_xref(name:"CERT", value:"456745");
    
      script_name(english:"MS09-035: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)");
      script_summary(english:"Checks for Visual Studio / Visual C++ patches");
    
      script_set_attribute(attribute:"synopsis", value:
    "Arbitrary code can be executed on the remote host through Microsoft
    Active Template Library.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host contains a version of the Microsoft Active
    Template Library (ATL), included as part of Visual Studio or Visual
    C++, that is affected by multiple vulnerabilities :
    
      - On systems with components and controls installed that
        were built using Visual Studio ATL, an issue in the ATL
        headers could allow an attacker to force VariantClear
        to be called on a VARIANT that has not been correctly
        initialized and, by supplying a corrupt stream, to
        execute arbitrary code. (CVE-2009-0901)
    
      - On systems with components and controls installed that
        were built using Visual Studio ATL, unsafe usage of
        OleLoadFromStream could allow instantiation of
        arbitrary objects that can bypass related security
        policy, such as kill bits within Internet Explorer.
        (CVE-2009-2493)
    
      - On systems with components and controls installed that
        were built using Visual Studio ATL, an issue in the ATL
        headers could allow a string to be read without a
        terminating NULL character, which could lead to
        disclosure of information in memory. (CVE-2009-2495)");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-035");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Visual Studio .NET 2003,
    Visual Studio 2005 and 2008, as well as Visual C++ 2005 and 2008.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(94, 200, 264);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/30");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio_.net");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_c++");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_reg_query.inc");
    include("misc_func.inc");
    include("audit.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    get_kb_item_or_exit("SMB/Registry/Uninstall/Enumerated");
    
    bulletin = 'MS09-035';
    kbs = make_list("973544", "973551", "973552", "973675");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    
    if (!get_kb_item("SMB/WindowsVersion")) exit(1, "SMB/WindowsVersion KB item is missing.");
    
    
    rootfile = hotfix_get_systemroot();
    if (!rootfile) exit(1, "Can't get system root.");
    
    commonfiles = hotfix_get_commonfilesdir();
    
    MAX_RECURSE = 3;
    
    
    port    =  kb_smb_transport();
    login   =  kb_smb_login();
    pass    =  kb_smb_password();
    domain  =  kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init");
    hcf_init = TRUE;
    
    function _list_dir(basedir, level, dir_pat, file_pat)
    {
      local_var contents, ret, subdirs, subsub;
    
      # nb: limit how deep we'll recurse.
      if (level > MAX_RECURSE) return NULL;
    
      subdirs = NULL;
      if (isnull(dir_pat)) dir_pat = "";
      ret = FindFirstFile(pattern:basedir + "\*" + dir_pat + "*");
    
      contents = make_list();
      while (!isnull(ret[1]))
      {
        if (file_pat && ereg(pattern:file_pat, string:ret[1], icase:TRUE))
          contents = make_list(contents, basedir+"\"+ret[1]);
    
        subsub = NULL;
        if ("." != ret[1] && ".." != ret[1] && level <= MAX_RECURSE)
          subsub  = _list_dir(basedir:basedir+"\"+ret[1], level:level+1, file_pat:file_pat);
        if (!isnull(subsub))
        {
          if (isnull(subdirs)) subdirs = make_list(subsub);
          else subdirs = make_list(subdirs, subsub);
        }
        ret = FindNextFile(handle:ret);
      }
    
      if (isnull(subdirs)) return contents;
      else return make_list(contents, subdirs);
    }
    
    
    # Returns the file version as a string, either from the KB or by
    # calling GetFileVersion(). Assumes we're already connected to the
    # correct share.
    function get_file_version()
    {
      local_var fh, file, ver, version;
    
      if (isnull(_FCT_ANON_ARGS[0])) return NULL;
    
      file = _FCT_ANON_ARGS[0];
      version = get_kb_item("SMB/FileVersions"+tolower(str_replace(string:file, find:"\", replace:"/")));
      if (isnull(version))
      {
        fh = CreateFile(
          file:file,
          desired_access:GENERIC_READ,
          file_attributes:FILE_ATTRIBUTE_NORMAL,
          share_mode:FILE_SHARE_READ,
          create_disposition:OPEN_EXISTING
        );
        if (!isnull(fh))
        {
          ver = GetFileVersion(handle:fh);
          CloseFile(handle:fh);
          if (!isnull(ver))
          {
            version = string(ver[0], ".", ver[1], ".", ver[2], ".", ver[3]);
            set_kb_item(
              name:"SMB/FileVersions"+tolower(str_replace(string:file, find:"\", replace:"/")),
              value:version
            );
          }
        }
      }
      return version;
    }
    
    
    
    #######################################################################
    # Check VC++ Redistributables.
    #######################################################################
    installs = make_array();
    
    # - Check if the redistributable is known to be installed; otherwise,
    #   we'll generate a false positive against Visual Studio.
    list = get_kb_list("SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/*/DisplayName");
    if (!isnull(list))
    {
      foreach name (keys(list))
      {
        prod = list[name];
        if (prod && ereg(pattern:"^Microsoft Visual C\+\+ 200[58] Redistributable", string:prod, icase:TRUE))
        {
          installs[tolower(prod)]++;
        }
      }
    }
    
    if (max_index(keys(installs)))
    {
      share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:rootfile);
      if (!is_accessible_share(share:share)) exit(1, "Can't access '"+share+"' share.");
    
      rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
      if (rc != 1)
      {
        NetUseDel();
        exit(1, "Can't access '"+share+"' share.");
      }
    
      fixed = make_array();
      probs = make_array();
      kbs = make_array();
      fixed_versions = make_array();
      fversions = make_array();
      prodfiles = make_array();
    
      winsxs = ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\WinSxS", string:rootfile);
      files = _list_dir(basedir:winsxs, level:0, dir_pat:"microsoft.vc?0.atl", file_pat:"^atl(80|90)\.dll$");
      if (!isnull(files))
      {
        foreach file (files)
        {
          if (ereg(pattern:"Microsoft\.VC80\.ATL", string:file, icase:TRUE))
          {
            prod = "Visual C++ 2005 SP1 Redistributable Package";
            fixed_versions[prod] = "8.0.50727.4053";
            prodfiles[prod] = "atl80.dll";
            kbs[prod] = '973544';
          }
          else if (ereg(pattern:"Microsoft\.VC90\.ATL.+_9\.0\.[0-2][0-9]+", string:file, icase:TRUE))
          {
            prod = "Visual C++ 2008 Redistributable Package";
            fixed_versions[prod] = "9.0.21022.218";
            prodfiles[prod] = "atl90.dll";
            kbs[prod] = '973551';
          }
          else if (ereg(pattern:"Microsoft\.VC90\.ATL.+_9\.0\.3[0-9]+", string:file, icase:TRUE))
          {
            prod = "Visual C++ 2008 SP1 Redistributable Package";
            fixed_versions[prod] = "9.0.30729.4148";
            prodfiles[prod] = "atl90.dll";
            kbs[prod] = '973552';
          }
          else continue;
    
          installed = FALSE;
          foreach key (keys(installs))
          {
            if (
              (" 2005 " >< prod && " 2005 " >< key) ||
              (
                " 2008 " >< prod && " 2008 " >< key &&
                (
                  ereg(pattern:" 9\.0\.[0-2][0-9]+", string:key) ||
                  (" SP1 " >< prod && ereg(pattern:" 9\.0\.3[0-9]+", string:key))
                )
              )
            )
            {
              installed = TRUE;
              break;
            }
          }
          if (!installed) continue;
    
          if (isnull(fixed[prod]) || fixed[prod] == 0)
          {
            version = get_file_version(file);
            fversions[prod] = version;
            if (!isnull(version))
            {
              if (version == fixed_versions[prod])
              {
                fixed[prod]++;
                if (prod == "Visual C++ 2008 SP1 Redistributable Package")
                {
                  fixed["Visual C++ 2008 Redistributable Package"]++;
                  probs[prod] = 0;
                }
                continue;
              }
    
              ver = split(version, sep:'.', keep:FALSE);
              for (i=0; i<max_index(ver); i++)
                ver[i] = int(ver[i]);
    
              fix = split(fixed_versions[prod], sep:'.', keep:FALSE);
              for (i=0; i<max_index(fix); i++)
                fix[i] = int(fix[i]);
    
              # Flag it if it's older or flag the fix if it's fixed.
              for (i=0; i<max_index(ver); i++)
                if ((ver[i] < fix[i]))
                {
                  fixed[prod] = 0;
                  probs[prod]++;
                  break;
                }
                else if (ver[i] > fix[i])
                {
                  fixed[prod]++;
                  probs[prod] = 0;
                  if (prod == "Visual C++ 2008 SP1 Redistributable Package")
                  {
                    fixed["Visual C++ 2008 Redistributable Package"]++;
                    probs[prod] = 0;
                  }
                  break;
                }
              }
          }
        }
      }
      NetUseDel(close:FALSE);
    
      # Report and exit if there's a problem.
      info = "";
      s = 0;
      foreach prod (keys(probs))
      {
        if (!fixed[prod]) s++;
      }
      if (s)
      {
        set_kb_item(name:'SMB/Missing/MS09-035', value:TRUE);
    
        if (s > 1) s = 's have';
        else s = ' has';
        info =
          '\n  The following Visual C++ Redistributable Package' + s + ' not' +
          '\n  been patched : \n';
        hotfix_add_report(info);
        foreach prod (keys(probs))
        {
          if (fixed[prod]) continue;
    
          info =
            '\n  Product           : ' + prod +
            '\n  File              : ' + prodfiles[prod] +
            '\n  Installed version : ' + fversions[prod] +
            '\n  Fixed version     : ' + fixed_versions[prod] + '\n';
          hotfix_add_report(info, bulletin:bulletin, kb:kbs[prod]);
        }
        hotfix_security_hole();
        exit(0);
      }
    }
    
    
    
    #######################################################################
    # Check Visual Studio installs.
    #######################################################################
    # - identify VCROOT for each install.
    installs = make_array();
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
    if (rc != 1)
    {
      NetUseDel();
      exit(1, "Can't connect to IPC$ share.");
    }
    
    hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
    if (isnull(hklm))
    {
      NetUseDel();
      exit(1, "Can't connect to remote registry.");
    }
    
    key = "SOFTWARE\Microsoft\VisualStudio";
    subkeys = get_registry_subkeys(handle:hklm, key:key, wow:TRUE);
    if (!isnull(subkeys))
    {
      if (report_paranoia < 2) pat = '^(7\\.1|8\\.0|9\\.0)$';
      else pat = '^[0-9]\\.[0-9]+$';
      foreach node (keys(subkeys))
      {
        key = node;
        foreach subkey (subkeys[node])
        {
          if (ereg(pattern:pat, string:subkey))
          {
            key2 = key + '\\' + subkey;
            path = get_registry_value(handle:hklm, item:key2 + "\InstallDir");
            if (!isnull(path))
            {
              path = ereg_replace(pattern:'^"(.+)"$', replace:"\1", string:path);
              vcroot = ereg_replace(pattern:"^(.+)\\Common7\\IDE\\$", replace:"\1", string:path, icase:TRUE);
              if (vcroot >< path) installs[subkey] = vcroot;
            }
          }
        }
      }
    }
    RegCloseKey(handle:hklm);
    NetUseDel(close:FALSE);
    
    # - locate possibly-affected files.
    atl_files = make_list();
    
    foreach ver (keys(installs))
    {
      if (ver =~ "^[89]\.")
      {
        vcroot = installs[ver];
    
        share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:vcroot);
        rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
        if (rc != 1)
        {
          NetUseDel();
          exit(1, "Can't access '"+share+"' share.");
        }
    
        path =  ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1", string:vcroot);
        files = _list_dir(basedir:path+"\VC\redist", level:0, file_pat:"^atl(80|90)\.dll$");
        if (!isnull(files))
        {
          foreach file (files)
          {
            atl_files = make_list(atl_files, (share-'$')+':'+file);
          }
        }
      }
      else
      {
        if (report_paranoia < 2) pat = "^atl(71|80|90)\.dll$";
        else pat = "^atl[0-9][0-9]\.dll$";
    
        basedirs = make_list(
          rootfile+"\System32",
          commonfiles+"\Microsoft Shared\Help",
          commonfiles+"\Microsoft Shared\VSA"
        );
    
        foreach basedir (basedirs)
        {
          share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:basedir);
          rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
          if (rc != 1)
          {
            NetUseDel();
            exit(1, "Can't access '"+share+"' share.");
          }
          basedir = ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1", string:basedir);
    
          if (ereg(pattern:"\System32$", string:basedir, icase:TRUE))
            files = _list_dir(basedir:basedir, level:MAX_RECURSE, file_pat:pat);
          else
            files = _list_dir(basedir:basedir, level:0, file_pat:pat);
          if (!isnull(files))
          {
            foreach file (files)
            {
                atl_files = make_list(atl_files, (share-'$')+':'+file);
            }
          }
          NetUseDel(close:FALSE);
        }
      }
    }
    NetUseDel(close:FALSE);
    
    
    # - check each file.
    vuln = 0;
    
    foreach atl (atl_files)
    {
      match = eregmatch(pattern:"^(.+)\\(atl[0-9]+\.dll)$", string:atl, icase:TRUE);
      if (match)
      {
        path = match[1];
        file = match[2];
    
        if (
          hotfix_check_fversion(file:file, version:"9.0.30729.4148", min_version:"9.0.30000.0", path:path, bulletin:bulletin, kb:'973675') == HCF_OLDER ||
          hotfix_check_fversion(file:file, version:"9.0.21022.218",  min_version:"9.0.0.0",     path:path, bulletin:bulletin, kb:'973674') == HCF_OLDER ||
          hotfix_check_fversion(file:file, version:"8.0.50727.4053", min_version:"8.0.0.0",     path:path, bulletin:bulletin, kb:'971090') == HCF_OLDER ||
          hotfix_check_fversion(file:file, version:"7.10.6101.0",                               path:path, bulletin:bulletin, kb:'971089') == HCF_OLDER
        ) vuln++;
      }
    }
    
    if (vuln)
    {
      set_kb_item(name:"SMB/Missing/MS09-035", value:TRUE);
      hotfix_security_hole();
    
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      exit(0, "The host is not affected");
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS09-060.NASL
    descriptionOne or more ActiveX controls included in Microsoft Outlook or Visio and installed on the remote Windows host was compiled with a version of Microsoft Active Template Library (ATL) that is affected by potentially several vulnerabilities : - An issue in the ATL headers could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized and, by supplying a corrupt stream, to execute arbitrary code. (CVE-2009-0901) - Unsafe usage of
    last seen2020-06-01
    modified2020-06-02
    plugin id42116
    published2009-10-14
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42116
    titleMS09-060: Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(42116);
      script_version("1.30");
      script_cvs_date("Date: 2018/11/15 20:50:30");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-2493", "CVE-2009-2495");
      script_bugtraq_id(35828, 35830, 35832);
      script_xref(name:"MSFT", value:"MS09-060");
      script_xref(name:"MSKB", value:"972363");
      script_xref(name:"MSKB", value:"973709");
      script_xref(name:"CERT", value:"456745");
    
      script_name(english:"MS09-060: Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)");
      script_summary(english:"Checks version of various files");
    
      script_set_attribute(attribute:"synopsis", value:
    "Arbitrary code can be executed on the remote host through Microsoft
    Office ActiveX controls.");
      script_set_attribute(attribute:"description", value:
    "One or more ActiveX controls included in Microsoft Outlook or Visio
    and installed on the remote Windows host was compiled with a version
    of Microsoft Active Template Library (ATL) that is affected by
    potentially several vulnerabilities :
    
      - An issue in the ATL headers could allow an attacker to
        force VariantClear to be called on a VARIANT that has
        not been correctly initialized and, by supplying a
        corrupt stream, to execute arbitrary code.
        (CVE-2009-0901)
    
      - Unsafe usage of 'OleLoadFromStream' could allow
        instantiation of arbitrary objects which can bypass
        related security policy, such as kill bits within
        Internet Explorer. (CVE-2009-2493)
    
      - An attacker who is able to run a malicious component or
        control built using Visual Studio ATL can, by
        manipulating a string with no terminating NULL byte,
        read extra data beyond the end of the string and thus
        disclose information in memory. (CVE-2009-2495)");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-060");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Microsoft Outlook 2002,
    2003, and 2007 as well as Visio Viewer 2007.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(94, 200, 264);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2009/10/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("audit.inc");
    
    include("misc_func.inc");
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS09-060';
    kbs = make_list("972363", "973709");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (!get_kb_item("SMB/Registry/Enumerated")) exit(1, "KB 'SMB/Registry/Enumerated' not set to TRUE.");
    
    
    # Determine the install path for Vision Viewer 2007.
    visio_viewer_path = NULL;
    
    port    =  kb_smb_transport();
    login   =  kb_smb_login();
    pass    =  kb_smb_password();
    domain  =  kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init");
    
    hcf_init = TRUE;
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
    if (rc != 1)
    {
      NetUseDel();
      audit(AUDIT_SHARE_FAIL, "IPC$");
    }
    
    # Connect to remote registry.
    hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
    if (isnull(hklm))
    {
      NetUseDel();
      audit(AUDIT_REG_FAIL);
    }
    
    key = "SOFTWARE\Microsoft\Office";
    key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
    if (!isnull(key_h))
    {
      value = RegQueryValue(handle:key_h, item:"InstallRoot");
      if (value) visio_viewer_path = value[1];
    
      RegCloseKey(handle:key_h);
    }
    if (isnull(visio_viewer_path))
    {
      key = "SOFTWARE\Microsoft\Office\12.0\Common\InstallRoot";
      key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
      if (!isnull(key_h))
      {
        value = RegQueryValue(handle:key_h, item:"Path");
        if (value) visio_viewer_path = value[1];
    
        RegCloseKey(handle:key_h);
      }
    }
    RegCloseKey(handle:hklm);
    NetUseDel(close:FALSE);
    
    
    vuln = 0;
    
    share = '';
    lastshare = '';
    accessibleshare = FALSE;
    #Office
    outlook_paths = get_kb_list("SMB/Office/Outlook/*/Path");
    if (!isnull(outlook_paths))
    {
      foreach install (keys(outlook_paths))
      {
        outlook_path = outlook_paths[install];
        share = hotfix_path2share(path:outlook_path);
    
        if (share != lastshare || !accessibleshare)
        {
          lastshare = share;
          if (is_accessible_share(share:share))
          {
            accessibleshare = TRUE;
          }
          else accessibleshare = FALSE;
        }
        if (accessibleshare)
        {
          # Outlook 2007
          if ("12.0" >< install)
          {
            if (hotfix_check_fversion(path:outlook_path, file:"Outlmime.dll", version:"12.0.6514.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'972363') == HCF_OLDER) vuln++;
          }
          # Outlook 2003
          else if ("11.0" >< install)
          {
            if (hotfix_check_fversion(path:outlook_path, file:"Outllib.dll", version:"11.0.8313.0", min_version:"11.0.0.0", bulletin:bulletin, kb:'973705') == HCF_OLDER) vuln++;
          }
          # Outlook 2002
          else if ("10.0" >< install)
          {
            if (hotfix_check_fversion(path:outlook_path, file:"Outllib.dll", version:"10.0.6856.0", min_version:"10.0.0.0", bulletin:bulletin, kb:'973702') == HCF_OLDER) vuln++;
          }
        }
      }
    }
    
    
    # Visio
    #
    # - Visio Viewer 2007.
    if (visio_viewer_path)
    {
      share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:visio_viewer_path);
      if (!is_accessible_share(share:share)) exit(1, "Can't access '"+share+"' share.");
    
      if (
        hotfix_check_fversion(path:visio_viewer_path, file:"Vpreview.exe", version:"12.0.6513.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'973709') == HCF_OLDER ||
        hotfix_check_fversion(path:visio_viewer_path, file:"Vviewdwg.dll", version:"12.0.6500.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'973709') == HCF_OLDER ||
        hotfix_check_fversion(path:visio_viewer_path, file:"vviewer.dll",  version:"12.0.6513.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'973709') == HCF_OLDER
      ) vuln++;
    }
    # - nb: we don't check for Visio Viewer 2002 and 2003 because the
    #       vulnerabilities are mitigated by applying MS09-034, and we
    #       do have a check for that.
    
    
    if (vuln)
    {
      set_kb_item(name:"SMB/Missing/MS09-060", value:TRUE);
      hotfix_security_hole();
    
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, 'affected');
    }
    

Oval

  • accepted2010-05-31T04:00:20.604-04:00
    classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameJ. Daniel Brown
      organizationDTCC
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationG2, Inc.
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentMicrosoft Visual Studio .NET 2003 SP1 is installed
      ovaloval:org.mitre.oval:def:168
    • commentMicrosoft Visual Studio 2005 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6401
    • commentMicrosoft Visual Studio 2008 is installed
      ovaloval:org.mitre.oval:def:5401
    • commentMicrosoft Visual Studio 2008 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6205
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6305
    statusdeprecated
    submitted2009-07-28T13:00:00
    titleATL Null String Vulnerability
    version81
  • accepted2009-11-30T04:00:47.349-05:00
    classvulnerability
    contributors
    • nameDragos Prisaca
      organizationGideon Technologies, Inc.
    • nameJ. Daniel Brown
      organizationDTCC
    • nameShane Shaffer
      organizationG2, Inc.
    definition_extensions
    • commentMicrosoft Outlook 2002 is installed
      ovaloval:org.mitre.oval:def:5179
    • commentMicrosoft Outlook 2003 is installed
      ovaloval:org.mitre.oval:def:5505
    • commentMicrosoft Outlook 2007 is installed
      ovaloval:org.mitre.oval:def:5352
    • commentMicrosoft Visio Viewer 2002 is installed
      ovaloval:org.mitre.oval:def:6500
    • commentMicrosoft Office Visio Viewer 2003 is installed
      ovaloval:org.mitre.oval:def:6420
    • commentMicrosoft Office Visio Viewer 2007 is installed
      ovaloval:org.mitre.oval:def:6128
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6478
    statusdeprecated
    submitted2009-10-13T13:00:00
    titleATL Null String Vulnerability
    version7
  • accepted2015-08-10T04:01:10.022-04:00
    classvulnerability
    contributors
    • nameJ. Daniel Brown
      organizationDTCC
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameMike Lah
      organizationThe MITRE Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameDragos Prisaca
      organizationSymantec Corporation
    • nameShane Shaffer
      organizationG2, Inc.
    • nameDragos Prisaca
      organizationG2, Inc.
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentMicrosoft Outlook 2002 is installed
      ovaloval:org.mitre.oval:def:5179
    • commentMicrosoft Outlook 2003 is installed
      ovaloval:org.mitre.oval:def:5505
    • commentMicrosoft Outlook 2007 is installed
      ovaloval:org.mitre.oval:def:5352
    • commentMicrosoft Visio Viewer 2002 is installed
      ovaloval:org.mitre.oval:def:6500
    • commentMicrosoft Office Visio Viewer 2003 is installed
      ovaloval:org.mitre.oval:def:6420
    • commentMicrosoft Office Visio Viewer 2007 is installed
      ovaloval:org.mitre.oval:def:6128
    • commentMicrosoft Visual Studio .NET 2003 SP1 is installed
      ovaloval:org.mitre.oval:def:168
    • commentMicrosoft Visual Studio 2005 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6401
    • commentMicrosoft Visual Studio 2008 is installed
      ovaloval:org.mitre.oval:def:5401
    • commentMicrosoft Visual Studio 2008 Service Pack 1 is installed
      ovaloval:org.mitre.oval:def:6205
    • commentMicrosoft Visual C++ 2005 Redistributable Package is installed
      ovaloval:org.mitre.oval:def:29007
    • commentMicrosoft Visual C++ 2008 Redistributable Package is installed
      ovaloval:org.mitre.oval:def:28587
    descriptionThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:7573
    statusaccepted
    submitted2010-01-12T23:30:00.000-05:00
    titleATL Null String Vulnerability
    version90

Seebug

bulletinFamilyexploit
descriptionBugraq ID: 35830 CVE ID:CVE-2009-2495 Microsoft Visual Studio是一款微软公司的开发工具套件系列产品。 Microsoft活动模版库(ATL)存在一个错误,远程攻击者可以利用漏洞获得敏感信息。 Microsoft活动模版库(ATL)读取字符串时没有使用终止NULL字符,攻击者可以操作这个字符串读取额外的数据而获取内存中的敏感信息。此漏洞只影响安装了使用Visual Studio ATL的组件和控件的系统。攻击者成功利用此漏洞允许运行恶意组件或控件来获得敏感信息,把用户数据转向到第三方或访问受影响系统上的任意数据。 Microsoft Visual Studio 2008 SP1 Microsoft Visual Studio 2008 0 Microsoft Visual Studio 2005 Team Edition for Testers 0 Microsoft Visual Studio 2005 Team Edition for Developers 0 Microsoft Visual Studio 2005 Team Edition for Architects 0 Microsoft Visual Studio 2005 Team Edition 0 Microsoft Visual Studio 2005 Standard Edition 0 Microsoft Visual Studio 2005 Professional Edition 0 Microsoft Visual Studio 2005 Premier Partner Edition - ENU 8.0.50727 .42 Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools SP1 Microsoft Visual Studio 2005 SP1 Microsoft Visual Studio 2005 Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual C++ 2008 SP1 Microsoft Visual C++ 2008 0 Microsoft Visual C++ 2005 SP1 厂商解决方案 用户可参考如下安全补丁: Microsoft Visual C++ 2005 SP1 Microsoft Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=766a6af7-ec73 -40ff-b072-9112bab119c2 Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual Studio .NET 2003 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?FamilyID=63ce454e-f69c -44e3-89fb-eb23c2e2154e Microsoft Visual Studio 2005 SP1 Microsoft Visual Studio 2005 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?FamilyID=7c8729dc-06a2 -4538-a90d-ff9464dc0197 Microsoft Visual C++ 2008 SP1 Microsoft Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=2051a0c1-c9b5 -4b0a-a8f5-770a549fd78c Microsoft Visual Studio 2008 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=294de390-3c94 -49fb-a014-9a38580e64cb Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools SP1 Microsoft Visual Studio 64-bit Hosted Visual C++ Tools 2005 Service Pack 1 ATL Security Update http://www.microsoft.com/downloads/details.aspx?FamilyID=43f96f2a-69c6 -4c5e-b72c-0edfa35f4fc2 Microsoft Visual C++ 2008 0 Microsoft Microsoft Visual C++ 2008 Redistributable Package ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=8b29655e-9da4 -4b6b-9ac5-687ca0770f93 Microsoft Visual Studio 2008 ATL Security Update http://www.microsoft.com/downloads/details.aspx?familyid=8f9da646-94dd -469d-baea-a4306270462c
idSSV:11915
last seen2017-11-19
modified2009-07-29
published2009-07-29
reporterRoot
titleMicrosoft Visual Studio ATL NULL字符串信息泄漏漏洞