Microsoft Windows, Internet Explorer, and Active Template Library (ATL)... (PC1-2009-1941)

Systems Affected are listed below:

• Microsoft Windows and Windows Server;
• Microsoft Internet Explorer;
• Microsoft Visual Studio and C++ Redistributable Package;
• ActiveX controls from multiple vendors.

Microsoft has released updates for critical vulnerabilities in Internet Explorer. The updates also include mitigations for attacks against vulnerable ActiveX controls that were created using vulnerable versions of the Active Template Library (ATL).

Vulnerabilities present in the ATL can cause vulnerabilities in the resulting ActiveX controls and COM components. For example, the ATL typographical error described in this Security Development Lifecycle blog post caused the Microsoft Video ActiveX control stack buffer overflow (VU#180513, CVE-2008-0015).

Any ActiveX control or COM component that was created with a vulnerable version of the ATL may be vulnerable. For example, Adobe and Cisco are affected.

If a user is persuaded to view a malicious HTML document (for example, a Web page, HTML email message, or HTML attachment), a malicious user might be able to execute arbitrary code.

System Administrators

In order to address the vulnerabilities in Internet Explorer and mitigate attacks against affected ATL-based ActiveX controls, users are recommended to apply the updates described in Microsoft Security Bulletin MS09-034. Further details about the ATL mitigations are available in a Microsoft Security Research & Defense blog post. Administrators are advised to think about using an automated update distribution system like Windows Server Update Services (WSUS).

Developers

In order to stop creating affected controls, developers are recommended to update the ATL as described in Microsoft Security Bulletin MS09-035. In order to address vulnerabilities in current controls, they are recommended to recompile the controls using the updated ATL. Further discussion about the ATL vulnerabilities could be found in the Security Development Lifecycle blog.