Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution
Description: This security update resolves several privately reported vulnerabilities in Microsoft Active Template Library (ATL). The vulnerabilities could allow remote code execution if a user loaded a specially crafted component or control hosted on a malicious website. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The security update addresses the vulnerabilities by modifying the ATL headers so that components and controls built using the headers can safely initialize from a data stream, and by providing updated versions of Windows components and controls built using corrected ATL headers.
Update type: Critical
Release date: August 11, 2009
Applies to: All versions
Knowledge base: http://support.microsoft.com/kb/973908
Download link: 32-bit | 64-bit
Comments:Here are the specifics on the vulnerabilities covered by this update:
- Microsoft Video ActiveX Control Vulnerability – CVE-2008-0015
- ATL Header Memcopy Vulnerability – CVE-2008-0020
- ATL Uninitialized Object Vulnerability – CVE-2009-0901
- ATL COM Initialization Vulnerability – CVE-2009-2493
- ATL Object Type Mismatch Vulnerability – CVE-2009-2494
For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB973908.