Microsoft Visual Studio Active Template Library Three Vulnerabilities

SA35967

CVE-2009-0901, CVE-2009-2493, CVE-2009-2495

28 Jul 2009

12 Jan 2010

Moderately Critical

Vendor Patch

Microsoft Visual C++ 2005 Redistributable Package (x86)
Microsoft Visual C++ 2008 Redistributable Package
Microsoft Visual Studio .NET 2003
Microsoft Visual Studio 2005
Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools
Microsoft Visual Studio 2008

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Security Bypass

This covers vulnerabilities or security issues where malicious users or people can bypass certain security mechanisms of the application.

The actual impact varies significantly depending on the design and purpose of the affected application.

Some vulnerabilities have been reported in Microsoft Visual Studio, which can be exploited by malicious people to potentially bypass security features, gain knowledge of sensitive information, or compromise applications built using ATL (Active Template Library).

1) An error in the ATL headers when handling persisted streams can be exploited to cause VariantClear() to be called on a VARIANT that has not been correctly initialised. This can e.g. be exploited to corrupt memory via a web page passing a specially crafted stream to a vulnerable control.

Successful exploitation may allow execution of arbitrary code.

2) An error in the ATL headers when handling object instantiation from data streams may allow bypassing of security policies such as kill-bits in Internet Explorer if a control or component uses OleLoadFromStream() in an unsafe manner.

3) An error in ATL may result in a string being read without terminating NULL bytes, which can be exploited to disclose memory contents beyond the end of the string.

Apply patches.

Microsoft Visual Studio .NET 2003 SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyID=63ce454e-f69c-44e3-89fb-eb23c2e2154e

Microsoft Visual Studio 2005 SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyID=7c8729dc-06a2-4538-a90d-ff9464dc0197

Microsoft Visual Studio 2005 SP1 64-bit Hosted Visual C++ Tools:
http://www.microsoft.com/downloads/details.aspx?FamilyID=43f96f2a-69c6-4c5e-b72c-0edfa35f4fc2

Windows Embedded CE 6.0:
http://www.microsoft.com/downloads/details.aspx?familyid=99d114f8-4d95-4075-a0f1-45f498f0ade8

Microsoft Visual Studio 2008:
http://www.microsoft.com/downloads/details.aspx?familyid=8f9da646-94dd-469d-baea-a4306270462c

Microsoft Visual Studio 2008 SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=294de390-3c94-49fb-a014-9a38580e64cb

Microsoft Visual C++ 2005 SP1 Redistributable Package:
http://www.microsoft.com/downloads/details.aspx?familyid=766a6af7-ec73-40ff-b072-9112bab119c2

Microsoft Visual C++ 2008 Redistributable Package:
http://www.microsoft.com/downloads/details.aspx?familyid=8b29655e-9da4-4b6b-9ac5-687ca0770f93

Microsoft Visual C++ 2008 SP1 Redistributable Package:
http://www.microsoft.com/downloads/details.aspx?familyid=2051a0c1-c9b5-4b0a-a8f5-770a549fd78c

Microsoft Visual Studio 2005 SP1 when developing mobile applications:
http://www.microsoft.com/downloads/details.aspx?FamilyID=9d7ee45b-9892-41b5-ac08-5fde9cde1b42

Microsoft Visual Studio 2008 when developing mobile applications:
http://www.microsoft.com/downloads/details.aspx?familyid=e3bb6602-b7f4-4614-9999-77f5c6f66ccd

Microsoft Visual Studio 2008 SP1 when developing mobile applications:
http://www.microsoft.com/downloads/details.aspx?familyid=75fbf397-5140-4961-92a9-78a88ba7228f

NOTE: It is also necessary for developers to rebuild any components and controls created using a vulnerable version of the ATL library.

1) The vendor credits David Dewey, IBM ISS X-Force.
2-3) The vendor credit Ryan Smith, iDefense Labs.

MS09-035 (KB969706, KB971089, KB971090, KB971091, KB971092, KB973544, KB973551, KB973552, KB973830, KB973673, KB973674, KB973675):
http://www.microsoft.com/technet/security/Bulletin/MS09-035.mspx