Vulnerability Note VU#456745
ActiveX controls built with Microsoft ATL fail to properly handle initialization data
ActiveX controls that are built using a Microsoft ATL template may fail to properly handle initialization data, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code.
Apply an update
This vulnerability has been addressed in the update for Internet Explorer provided in Microsoft Security Bulletin MS09-034. This update helps prevent ActiveX controls that were built with the vulnerable ATL versions from being initialized with unsafe data patterns in Internet Explorer. This also includes techniques that can be used to bypass the kill bit in Internet Explorer.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Adobe||Affected||-||30 Jul 2009|
|Aurigma Inc.||Affected||28 Jul 2009||29 Jul 2009|
|Cisco Systems, Inc.||Affected||28 Jul 2009||29 Jul 2009|
|F5 Networks, Inc.||Affected||28 Jul 2009||29 Jul 2009|
|Microsoft Corporation||Affected||-||28 Jul 2009|
|OSISoft||Affected||-||04 Aug 2009|
|SoftArtisans, Inc||Affected||28 Jul 2009||24 Feb 2010|
|SonicWall||Affected||28 Jul 2009||28 Oct 2009|
|Sun Microsystems, Inc.||Affected||-||05 Aug 2009|
|Apple Inc.||Not Affected||28 Jul 2009||31 Jul 2009|
|IBM Corporation||Not Affected||28 Jul 2009||29 Jul 2009|
|LogicNP||Not Affected||28 Jul 2009||30 Jul 2009|
|VanDyke Software||Not Affected||28 Jul 2009||04 Aug 2009|
|Alcatel-Lucent||Unknown||28 Jul 2009||28 Jul 2009|
|America Online, Inc.||Unknown||28 Jul 2009||28 Jul 2009|
CVSS Metrics (Learn More)
Thanks to Microsoft for reporting this vulnerability, who in turn credit David Dewey of IBM ISS X-Force and Ryan Smith of Verisign iDefense labs.
This document was written by Will Dormann.
- CVE IDs: CVE-2009-0901 CVE-2009-2493 CVE-2009-2495
- US-CERT Alert: TA09-209A
- Date Public: 09 Jul 2009
- Date First Published: 28 Jul 2009
- Date Last Updated: 24 Feb 2010
- Severity Metric: 47.08
- Document Revision: 44
If you have feedback, comments, or additional information about this vulnerability, please send us email.