漏洞信息详情

Microsoft Visual Studio ATL空字符串信息泄露漏洞

• CNNVD编号：CNNVD-200907-416
• 危害等级： 中危
  
• CVE编号： CVE-2009-2495
• 漏洞类型： 信息泄露
• 发布时间： 2009-07-29
• 威胁类型： 远程
• 更新时间： 2009-11-17
• 厂        商： microsoft
• 漏洞来源： Ryan Smith ryan@hu...

漏洞简介

Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具 。

Visual Studio所编译的ATL库可能允许读取没有截止空字符的字符串。攻击者可以操控这个字符串越界读取额外的数据，泄露内存中的信息。这个漏洞仅直接影响安装了使用Visual Studio ATL所编译的组件和控件的系统。成功利用这个漏洞的攻击者可以运行恶意的组件或控件，导致泄漏信息、向第三方转发用户数据，或在受影响的系统上访问登录用户可访问的任意数据。请注意这个漏洞不允许攻击者直接执行代码或提升权限，但所泄露的信息可用于对受影响系统的进一步入侵 。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Microsoft Outlook 2007 SP2 0

Microsoft Update for Microsoft Office Outlook 2007 (KB972363)

http://www.microsoft.com/downloads/details.aspx?FamilyId=d39234a3-c62c -44ba-a626-3179a183ca09

Microsoft Visual C++ 2005 SP1

Microsoft Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=766a6af7-ec73 -40ff-b072-9112bab119c2

Microsoft Visio Viewer 2007 SP1 0

Microsoft Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

http://www.microsoft.com/downloads/details.aspx?FamilyId=d20004c5-dd01 -459e-8120-5f127e20c085

Microsoft Outlook 2007 SP1 0

Microsoft Update for Microsoft Office Outlook 2007 (KB972363)

http://www.microsoft.com/downloads/details.aspx?FamilyId=d39234a3-c62c -44ba-a626-3179a183ca09

Microsoft Visual Studio 2008 SP1

Microsoft Visual Studio 2008 Service Pack 1 ATL for Smart Devices Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=75fbf397-5140 -4961-92a9-78a88ba7228f&displaylang=en

Microsoft Visual C++ 2008 SP1

Microsoft Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=2051a0c1-c9b5 -4b0a-a8f5-770a549fd78c

Microsoft Visual Studio 2008 Service Pack 1 ATL Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=294de390-3c94 -49fb-a014-9a38580e64cb

Microsoft Outlook 2003 SP3

Microsoft Security Update for Microsoft Office Outlook 2003 (KB973705)

http://www.microsoft.com/downloads/details.aspx?FamilyId=79e2b2e8-d5e8 -4014-b489-720af2b5083d

Microsoft Windows CE 6.0

Microsoft Security Update Windows Embedded CE 6.0 (KB974616)

http://www.microsoft.com/downloads/details.aspx?familyid=99d114f8-4d95 -4075-a0f1-45f498f0ade8

Microsoft Visual Studio .NET 2003 SP1

Microsoft Visual Studio .NET 2003 Service Pack 1 ATL Security Update

http://www.microsoft.com/downloads/details.aspx?FamilyID=63ce454e-f69c -44e3-89fb-eb23c2e2154e

Microsoft Visio Viewer 2007 0

Microsoft Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

http://www.microsoft.com/downloads/details.aspx?FamilyId=d20004c5-dd01 -459e-8120-5f127e20c085

Microsoft Visual Studio 2008 0

Microsoft Visual Studio 2008 ATL for Smart Devices Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=e3bb6602-b7f4 -4614-9999-77f5c6f66ccd&displaylang=en

Microsoft Visio Viewer 2007 SP2 0

Microsoft Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

http://www.microsoft.com/downloads/details.aspx?FamilyId=d20004c5-dd01 -459e-8120-5f127e20c085

Microsoft Visual Studio 2005 SP1

Microsoft Visual Studio 2005 Service Pack 1 ATL for Smart Devices Security Update

http://www.microsoft.com/downloads/details.aspx?FamilyID=9d7ee45b-9892 -41b5-ac08-5fde9cde1b42&displaylang=en

Microsoft Visual Studio 2005 Service Pack 1 ATL Security Update

http://www.microsoft.com/downloads/details.aspx?FamilyID=7c8729dc-06a2 -4538-a90d-ff9464dc0197

Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools SP1

Microsoft Visual Studio 64-bit Hosted Visual C++ Tools 2005 Service Pack 1 ATL Security Update

http://www.microsoft.com/downloads/details.aspx?FamilyID=43f96f2a-69c6 -4c5e-b72c-0edfa35f4fc2

Microsoft Visual C++ 2008 0

Microsoft Microsoft Visual C++ 2008 Redistributable Package ATL Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=8b29655e-9da4 -4b6b-9ac5-687ca0770f93

Microsoft Visual Studio 2008 ATL Security Update

http://www.microsoft.com/downloads/details.aspx?familyid=8f9da646-94dd -469d-baea-a4306270462c

参考网址

来源: US-CERT

名称: TA09-286A

链接:http://www.us-cert.gov/cas/techalerts/TA09-286A.HTML

来源; US-CERT

名称: TA09-195A

链接:http://www.us-cert.gov/cas/techalerts/TA09-195A.HTML

来源: MS

名称: MS09-035

链接:http://www.microsoft.com/technet/security/Bulletin/MS09-035.mspx

来源: VUPEN

名称: ADV-2009-2034

链接:http://www.vupen.com/english/advisories/2009/2034

来源: MS

名称: MS09-060

链接:http://www.microsoft.com/technet/security/Bulletin/MS09-060.mspx

来源: www.adobe.com

链接:http://www.adobe.com/support/security/bulletins/apsb09-13.HTML

来源: www.adobe.com

链接:http://www.adobe.com/support/security/bulletins/apsb09-10.HTML

来源: SUNALERT

名称: 266108

链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1

来源: SECUNIA

名称: 36374

链接:http://secunia.com/advisories/36374

受影响实体

• Microsoft Visual_c%2b%2b:2008:Sp1_redistribution_pkg  
• Microsoft Visual_c%2b%2b:2008:Redistribution_pkg  
• Microsoft Visual_c%2b%2b:2005:Sp1_redistribution_pkg  
• Microsoft Visual_studio:2008:Sp1  
• Microsoft Visual_studio:2008  

补丁

暂无