(Sun Issues Fix for Sun Java Web Start) Microsoft Visual Studio Active Template Library Bugs Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1022662 |
|
SecurityTracker URL: http://securitytracker.com/id/1022662
|
|
CVE Reference:
CVE-2009-0901, CVE-2009-2493, CVE-2009-2495
(Links to External Site)
|
Date: Aug 5 2009
|
Impact:
Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Several vulnerabilities were reported in Microsoft Visual Studio. A remote user can cause arbitrary code to be executed on the target user's system. Sun Java is affected.
A remote user can create a specially crafted file that, when loaded by the target user, will trigger a flaw in the Microsoft Active Template Library (ATL) and execute arbitrary code on the target system. The code will run with the privileges of the target user.
A specially crafted ATL header can cause the VariantClear() function to be called on an incorrectly initialized VARIANT [CVE-2009-0901].
A specially crafted ATL header can invoke OleLoadFromStream() to instantiate arbitrary objects that can bypass related security policy [CVE-2009-2493].
A specially crafted string without a terminating NULL character may allow a remote user to obtain potentially sensitive information [CVE-2009-2495].
David Dewey of IBM ISS X-Force reported one of the vulnerabilities. Ryan Smith of VeriSign iDefense Labs reported the other two vulnerabilities.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system or access potentially sensitive information on the target user's system.
|
Solution:
Sun has issued a fix for Sun Java for Windows, which is affected by this vulnerability:
* JDK and JRE 6 Update 15 or later
* JDK and JRE 5.0 Update 20 or later
and in the following Java SE for Business release for Windows:
* SDK and JRE 1.4.2_22 or later
Java SE releases are available at:
JDK and JRE 6 Update 15:
http://java.sun.com/javase/downloads/index.jsp
JRE 6 Update 15:
http://java.com/
through the Java Update tool for Microsoft Windows users.
JDK and JRE 5.0 Update 20:
http://java.sun.com/javase/downloads/index_jdk5.jsp
Java SE for Business releases are available at:
http://www.sun.com/software/javaseforbusiness/getit_download.jsp
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264648-1
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms09-035.mspx (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 4 Aug 2009 20:03:43 -0400
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-66-264648-1
|
264648
Security Vulnerability in the Active Template Library in Various Releases of Microsoft
Visual Studio Used by the Java Web Start ActiveX Control May Be Leveraged to Execute
Arbitrary Code
|
|
