Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMicrosoftCVE-2009-2493
HistoryJul 29, 2009 - 5:30 p.m.

CVE-2009-2493

2009-07-2917:30:01
CWE-264
microsoft
web.nvd.nist.gov
146
atl
com
initialization
vulnerability
microsoft
visual studio
windows
cve-2009-2493
nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.2

Confidence

Low

EPSS

0.661

Percentile

97.9%

JSON

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka β€œATL COM Initialization Vulnerability.”

Affected configurations

Nvd
Node
microsoftvisual_c\+\+Match2005sp1
OR
microsoftvisual_c\+\+Match2008
OR
microsoftvisual_c\+\+Match2008sp1
Node
microsoftwindows_2000sp4
OR
microsoftwindows_2003_serversp2
OR
microsoftwindows_server_2008sp2
OR
microsoftwindows_server_2008Match-
OR
microsoftwindows_vistasp1
OR
microsoftwindows_vistasp2
OR
microsoftwindows_vistaMatch-
OR
microsoftwindows_xpsp2
OR
microsoftwindows_xpsp3
Node
microsoftvisual_studioMatch2003sp1
OR
microsoftvisual_studioMatch2005sp1
OR
microsoftvisual_studioMatch2008
OR
microsoftvisual_studioMatch2008sp1
VendorProductVersionCPE
microsoftvisual_c%2B%2B2008cpe:/a:microsoft:visual_c%2B%2B:2008:sp1::
microsoftvisual_c%2B%2B2008cpe:/a:microsoft:visual_c%2B%2B:2008:::
microsoftvisual_c%2B%2B2005cpe:/a:microsoft:visual_c%2B%2B:2005:sp1::

References

Related

securityvulns 9
cvelist 1
openvas 14
nessus 20
prion 1
seebug 1
mskb 3
checkpoint_advisories 4
nvd 1
cert 1
f5 1
threatpost 1
freebsd 1
suse 3
securityvulns
securityvulns
iDefense Security Advisory 07.28.09: Multiple Vendor Microsoft ATL/MFC ActiveX Security Bypass Vulnerability
2009-08-20 00:00:00
Microsoft Security Bulletin MS09-055 - Critical Cumulative Security Update of ActiveX Kill Bits (973525)
2009-10-13 00:00:00
Microsoft Active Template Library (ATL) multiple security vulnerabilities
2009-10-13 00:00:00
cvelist
cvelist
CVE-2009-2493
2009-07-29 17:00:00
openvas
openvas
Microsoft Windows ATL COM Initialization Code Execution Vulnerability (973525)
2009-10-14 00:00:00
Microsoft Windows ATL COM Initialization Code Execution Vulnerability (973525)
2009-10-14 00:00:00
Microsoft Visual Studio ATL Remote Code Execution Vulnerability (969706)
2009-08-03 00:00:00
nessus
nessus
MS09-055: Cumulative Security Update of ActiveX Kill Bits (973525)
2009-10-13 00:00:00
MS09-060: Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)
2009-10-14 00:00:00
MS09-035: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)
2009-07-30 00:00:00
prion
prion
Design/Logic Flaw
2009-07-29 17:30:00
seebug
seebug
Microsoft Visual Studio ATL COMε―Ήθ±‘θΏœη¨‹δ»£η ζ‰§θ‘ŒζΌζ΄ž
2009-07-29 00:00:00
mskb
mskb
MS09-055: Cumulative Security Update of ActiveX Kill Bits
2020-04-13 02:02:28
MS09-035: Vulnerabilities in Visual Studio Active Template Libraries could allow remote code execution
2018-04-17 20:27:28
MS09-037: Vulnerabilities in Microsoft Active Template Library (ATL) could allow remote code execution
2019-11-06 02:17:02
checkpoint_advisories
checkpoint_advisories
Microsoft Outlook View ActiveX Controls Remote Code Execution (MS09-055; CVE-2009-2493)
2009-10-01 00:00:00
Microsoft ATL Multiple ActiveX Remote Code Executions (MS09-037; CVE-2008-0020; CVE-2009-2493; CVE-2009-2494)
2009-09-08 00:00:00
Update Protection against Microsoft Office Web Components Multiple ActiveX Controls Remote Code Execution Vulnerability (MS09-043)
2009-07-13 00:00:00
nvd
nvd
CVE-2009-2493
2009-07-29 17:30:01
cert
cert
ActiveX controls built with Microsoft ATL fail to properly handle initialization data
2009-07-28 00:00:00
f5
f5
SOL10441 - Microsoft Active Template Library (ATL) vulnerabilities VU#456745
2009-08-17 00:00:00
threatpost
threatpost
OpenOffice Zaps Six Security Bugs
2010-02-18 15:09:26
freebsd
freebsd
openoffice.org -- multiple vulnerabilities
2006-08-24 00:00:00
suse
suse
remote code execution in java-1_6_0-ibm
2009-11-04 15:26:34
remote code execution in java-1_5_0-ibm
2010-01-12 09:21:12
remote code execution in flash-player
2009-08-05 14:55:37

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.2

Confidence

Low

EPSS

0.661

Percentile

97.9%

JSON
Related for CVE-2009-2493
securityvulns9cvelist1openvas14nessus20prion1seebug1mskb3checkpoint_advisories4nvd1cert1f51threatpost1freebsd1suse3