Microsoft Visual Studio ATL Remote Code Execution Vulnerability (969706)

This host is missing a critical security update according to Microsoft Bulletin MS09-035.

- An error in the ATL headers when handling persisted streams can be exploited to cause VariantClear function to be called on a VARIANT that has not been correctly initialised via a specially crafted web page. - An error in the ATL headers when handling object instantiation from data streams may allow bypassing of security policies such as kill-bits in Internet Explorer if a control or component uses OleLoadFromStream function in an unsafe manner. - An error in ATL may result in a string being read without terminating NULL bytes, which can be exploited to disclose memory contents beyond the end of the string.

Microsoft Visual Studio 2005 SP 1 and prior Microsoft Visual Studio 2008 SP 1 and prior Microsoft Visual Studio .NET 2003 SP 1 and prior

The vendor has released updates. Please see the references for more information.