阿里云漏洞库

中危 visual_studio,visual_c++,visual_studio_.net 代码执行漏洞

CVE编号

CVE-2009-0901

利用情况

暂无

补丁情况

官方补丁

披露时间

2009-07-30

漏洞描述

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve...
http://marc.info/?l=bugtraq&m=126592505426855&w=2
http://secunia.com/advisories/35967
http://secunia.com/advisories/36187
http://secunia.com/advisories/36374
http://secunia.com/advisories/36746
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
http://www.adobe.com/support/security/advisories/apsa09-04.html
http://www.adobe.com/support/security/bulletins/apsb09-10.html
http://www.adobe.com/support/security/bulletins/apsb09-11.html
http://www.adobe.com/support/security/bulletins/apsb09-13.html
http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1
http://www.securityfocus.com/bid/35832
http://www.us-cert.gov/cas/techalerts/TA09-195A.html
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.us-cert.gov/cas/techalerts/TA09-286A.html
http://www.vupen.com/english/advisories/2009/2034
http://www.vupen.com/english/advisories/2009/2232
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	microsoft	visual_c++	2005	-
	运行在以下环境
	应用	microsoft	visual_c++	2008	-
	运行在以下环境
	应用	microsoft	visual_studio	2005	-
	运行在以下环境
	应用	microsoft	visual_studio	2008	-
	运行在以下环境
	应用	microsoft	visual_studio_.net	2003	-
	运行在以下环境
	系统	suse_12	flash-player	*		Up to (excluding) 11.2.202.406-1

攻击路径

本地
攻击复杂度

容易
权限要求

无需权限
影响范围

全局影响
EXP成熟度

未验证
补丁情况

官方补丁
数据保密性

数据泄露
数据完整性

无影响
服务器危害

无影响
全网数量

N/A

CWE-ID	漏洞类型
CWE-94	对生成代码的控制不恰当（代码注入）

中危 visual_studio,visual_c++,visual_studio_.net 代码执行漏洞

漏洞描述

解决建议

参考链接

受影响软件情况