CVE-2009-2493
Published Jul 29, 2009
Last updated 6 years ago
Overview
- Description
- The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
- Source
- secure@microsoft.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 9.3
- Impact score
- 10
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- CWE-264
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:visual_c\\+\\+:2005:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "882CDAE9-EC03-48E6-814C-50236B8F0B93"
},
{
"criteria": "cpe:2.3:a:microsoft:visual_c\\+\\+:2008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27438900-81A7-41CD-AA17-1DA9F35C98D1"
},
{
"criteria": "cpe:2.3:a:microsoft:visual_c\\+\\+:2008:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A4E0021F-ABB9-4FB4-BC1C-5098F2E66371"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83E7C4A0-78CF-4B56-82BF-EC932BDD8ADF"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2978BF86-5A1A-438E-B81F-F360D0E30C9C"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C28897B-044A-447B-AD76-6397F8190177"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32623D48-7000-4C7D-823F-7D2A9841D88C"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C162FFF0-1E8F-4DCF-A08F-6C6E324ED878"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A0D2704-C058-420B-B368-372D1129E914"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CAEEA81-5037-4B68-98D9-83AAEBC98E20"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE477A73-4EE4-41E9-8694-5A3D5DC88656"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:visual_studio:2003:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9AD97AF-1F2A-483D-86F2-764ECEC31BD1"
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio:2005:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9271AF1C-9B1C-4ADB-9F54-E63EBA2910F9"
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED077FFC-EBCC-4CD9-BF0E-0286B99C1965"
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9AB2C8C4-7E86-4736-9CE4-2E65E4EDBF02"
}
],
"operator": "OR"
}
]
}
]